joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3de1
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov eax, dword [0x4ef1f0]
mov esi, esi
mov ebp, esp
sub esp, 0x118
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 0x114], 0xffffffff
push edi
push ebx
xor edi, edi
lea ebx, [ebp - 0x10c]
cmp eax, edi
mov dword [ebp - 0x118], edi
jne 0x4b3e3b
call fcn.004a6a5e
mov dword [eax], edi
call fcn.004a6a4b
push edi
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
call fcn.004a648d
add esp, 0x14
or eax, 0xffffffff
jmp 0x4b3f0b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or eax, eax
je 0x4b3ee8
lea eax, [ebp - 0x10c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, 0x104
jle 0x4b3e94
push 1
lea edi, [esi + 1]
push edi
call fcn.004b7d03
pop ecx
pop ecx
mov ebx, eax
or ebx, ebx
je 0x4b3ee6
mov dword [ebp - 0x118], 1
test esi, esi
je 0x4b3ee6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x4b3ee8
mov al, byte [ebx]
cmp al, 0x5c
je 0x4b3ea2
cmp al, 0x2f
jne 0x4b3ea7
cmp al, byte [ebx + 1]
je 0x4b3ede
mov byte [ebp - 0x110], 0x3d
movzx eax, byte [ebx]
push eax
call fcn.004c0899
pop ecx
mov byte [ebp - 0x10f], al
push ebx
lea eax, [ebp - 0x110]
push eax
mov byte [ebp - 0x10e], 0x3a
mov byte [ebp - 0x10d], 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x4b3ee8
mov dword [ebp - 0x114], edi
jmp 0x4b3ef5
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004a6a71
pop ecx
pop esi
cmp dword [ebp - 0x118], edi
je 0x4b3f05
push ebx
call fcn.004a7a46
pop ebx
mov eax, dword [ebp - 0x114]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004b7a8b
leave
ret
Function at 0x4b519d
Capabilities:
Timestomp file

Disassembly:
mov esi, esi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add esp, 0xffffffac
cmp eax, 0xfffffffe
jne 0x4b51bd
call fcn.004a6a4b
mov dword [eax], 9
leave
or eax, 0xffffffff
ret
push esi
xor esi, esi
cmp eax, esi
jl 0x4b51e5
cmp eax, dword [0x5001a4]
jae 0x4b51e5
mov ecx, eax
sar ecx, 5
mov ecx, dword [ecx*4 + 0x5001c0]
and eax, 0x1f
shl eax, 6
test byte [ecx + eax + 4], 1
jne 0x4b5205
call fcn.004a6a4b
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 9
call fcn.004a648d
add esp, 0x14
or eax, 0xffffffff
jmp 0x4b534a
push edi
mov edi, dword [ebp + 0xc]
cmp edi, esi
jne 0x4b5220
lea eax, [ebp - 4]
push eax
call fcn.004beed4
pop ecx
lea edi, [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004bec7e
or eax, eax
pop ecx
pop ecx
je 0x4b5246
call fcn.004a6a4b
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x4b5349
mov eax, dword [ebp - 0x40]
sub eax, 0xfffff894
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x44]
inc eax
mov word [ebp - 0x2e], ax
mov ax, word [ebp - 0x48]
mov word [ebp - 0x2a], ax
mov ax, word [ebp - 0x4c]
mov word [ebp - 0x28], ax
mov ax, word [ebp - 0x50]
mov word [ebp - 0x26], ax
mov ax, word [ebp - 0x54]
mov word [ebp - 0x24], ax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call ebx
or eax, eax
je 0x4b533a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
or eax, eax
je 0x4b533a
push edi
lea eax, [ebp - 0x54]
push eax
call fcn.004bec7e
pop edi
or eax, eax
pop ecx
jne 0x4b533a
mov eax, dword [ebp - 0x40]
add eax, 0x76c
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x44]
inc eax
mov word [ebp - 0x2e], ax
mov ax, word [ebp - 0x48]
mov word [ebp - 0x2a], ax
mov ax, word [ebp - 0x4c]
mov word [ebp - 0x28], ax
mov ax, word [ebp - 0x50]
mov word [ebp - 0x26], ax
mov ax, word [ebp - 0x54]
mov word [ebp - 0x24], ax
xor eax, eax
mov word [ebp - 0x22], ax
lea edi, [ebp - 0x10]
push edi
lea eax, [ebp - 0x30]
push eax
call ebx
test eax, eax
je 0x4b533a
lea eax, [ebp - 0x10]
lea edi, [ebp - 0x20]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
or eax, eax
je 0x4b533a
lea eax, [ebp - 0x20]
lea ebx, [ebp - 0x18]
push ebx
push eax
push esi
push dword [ebp + 8]
call fcn.004a6b9b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x4b533a
xor eax, eax
jmp 0x4b5348
call fcn.004a6a4b
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4b541e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, dword [edi*8 + 0x4eef88]
je 0x4b5444
inc edi
mov dword [ebp - 4], edi
cmp edi, 0x17
jb 0x4b5432
cmp edi, 0x17
jae 0x4b55c4
push 3
call fcn.004b857c
pop ecx
cmp eax, 1
je 0x4b5592
push 3
call fcn.004b857c
test eax, eax
pop ecx
jne 0x4b5477
cmp dword [0x4ee8b0], 1
je 0x4b5592
cmp ebx, 0xfc
je 0x4b55c4
mov ebx, 0x314
push str.Runtime_Error__n_nProgram:
mov edi, 0x4fdfc8
push ebx
push edi
call fcn.004b7c39
add esp, 0xc
or eax, eax
je 0x4b54ad
push esi
push esi
push esi
push esi
push esi
call fcn.004a633e
add esp, 0x14
mov esi, 0x4fdfe1
push 0x104
push esi
push 0
mov byte [0x4fe0e5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b54f1
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004b7c39
add esp, 0xc
test eax, eax
je 0x4b54f1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004a633e
add esp, 0x14
push esi
call fcn.004a7700
pop ecx
inc eax
cmp eax, 0x3c
jbe 0x4b5536
push esi
call fcn.004a7700
add esi, 0xffffffc5
push 3
add eax, esi
mov ecx, 0x4fe2dc
sub ecx, eax
push 0x4cd464
push ecx
push eax
call fcn.004b931d
sub esp, 0xffffffec
test eax, eax
je 0x4b5536
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004a633e
add esp, 0x14
jmp 0x4b5538
xor esi, esi
push 0x4cd460
push ebx
push edi
call fcn.004bd040
add esp, 0xc
test eax, eax
je 0x4b5558
push esi
push esi
push esi
push esi
push esi
call fcn.004a633e
sub esp, 0xffffffec
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x4eef8c]
push ebx
push edi
call fcn.004bd040
add esp, 0xc
test eax, eax
je 0x4b557d
push esi
push esi
push esi
push esi
push esi
call fcn.004a633e
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push edi
call fcn.004c0bbc
sub esp, 0xfffffff4
jmp 0x4b55c4
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
cmp ebx, esi
je 0x4b55c4
cmp ebx, 0xffffffff
je 0x4b55c4
lea esi, [edi*8 + 0x4eef8c]
push 0
lea eax, [ebp - 8]
push eax
push dword [esi]
call fcn.004a7700
pop ecx
push eax
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b5a95
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov eax, dword [0x4fe3e8]
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor edi, edi
cmp eax, ebx
jne 0x4b5ae1
call esi
mov edi, eax
cmp edi, ebx
je 0x4b5ac7
mov dword [0x4fe3e8], 1
jmp 0x4b5aea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4b5adc
push 2
pop eax
mov dword [0x4fe3e8], eax
jmp 0x4b5ae1
mov eax, dword [0x4fe3e8]
cmp eax, 1
jne 0x4b5b6b
cmp edi, ebx
jne 0x4b5afd
call esi
mov edi, eax
cmp edi, ebx
jne 0x4b5afd
xor eax, eax
jmp 0x4b5bc7
mov eax, edi
cmp word [edi], bx
je 0x4b5b12
inc eax
inc eax
cmp word [eax], bx
jne 0x4b5b04
inc eax
inc eax
cmp word [eax], bx
jne 0x4b5b04
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub eax, edi
sar eax, 1
push ebx
inc eax
push ebx
push ebx
push ebx
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4b5b60
push eax
call fcn.004b7cbe
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x4b5b60
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
or eax, eax
jne 0x4b5b5d
push dword [ebp - 4]
call fcn.004a7a46
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x4b5bc7
cmp eax, 2
je 0x4b5b74
cmp eax, ebx
jne 0x4b5af6
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x4b5af6
cmp byte [esi], bl
je 0x4b5b92
inc eax
cmp byte [eax], bl
jne 0x4b5b88
inc eax
cmp byte [eax], bl
jne 0x4b5b88
sub eax, esi
inc eax
push eax
mov dword [ebp - 8], eax
call fcn.004b7cbe
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x4b5bb1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x4b5af6
push dword [ebp - 8]
push esi
push edi
call fcn.004a86b0
sub esp, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b632d
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, str.KERNEL32.DLL
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
or eax, eax
jne 0x4b6348
push esi
call fcn.004a5f08
pop ecx
mov esi, eax
or esi, esi
je 0x4b64b0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlsAlloc
push esi
call edi
push str.FlsGetValue
push esi
mov dword [0x4fe3ec], eax
call edi
push str.FlsSetValue
push esi
mov dword [0x4fe3f0], eax
call edi
push str.FlsFree
push esi
mov dword [0x4fe3f4], eax
call edi
cmp dword [0x4fe3ec], 0
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4fe3f8], eax
je 0x4b63b1
cmp dword [0x4fe3f0], 0
je 0x4b63b1
cmp dword [0x4fe3f4], 0
je 0x4b63b1
test eax, eax
jne 0x4b63d5
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x4fe3f0], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x4fe3ec], 0x4b5f59
mov dword [0x4fe3f4], edi
mov dword [0x4fe3f8], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4ef094], eax
cmp eax, 0xffffffff
je 0x4b64b5
push dword [0x4fe3f0]
push eax
call edi
or eax, eax
je 0x4b64b5
call fcn.004a61f2
push dword [0x4fe3ec]
call fcn.004b5e6c
push dword [0x4fe3f0]
mov dword [0x4fe3ec], eax
call fcn.004b5e6c
push dword [0x4fe3f4]
mov dword [0x4fe3f0], eax
call fcn.004b5e6c
push dword [0x4fe3f8]
mov dword [0x4fe3f4], eax
call fcn.004b5e6c
add esp, 0x10
mov dword [0x4fe3f8], eax
call fcn.004b6842
or eax, eax
je 0x4b64b0
push fcn.004b618a
push dword [0x4fe3ec]
call fcn.004b5ee7
pop ecx
call eax
mov dword [0x4ef090], eax
cmp eax, 0xffffffff
je 0x4b64b0
push 0x214
push 1
call fcn.004b7d03
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4b64b0
push edi
push dword [0x4ef090]
push dword [0x4fe3f4]
call fcn.004b5ee7
pop ecx
call eax
or eax, eax
je 0x4b64b0
push 0
push edi
call fcn.004b6010
pop esi
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [edi + 4], 0xffffffff
mov dword [edi], eax
xor eax, eax
inc eax
jmp 0x4b64b7
call fcn.004b5fd3
xor eax, eax
pop edi
pop esi
ret

Function at 0x4b6a20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov edx, 0x5a4d
mov ecx, esp
mov edi, edi
mov eax, dword [ecx + 8]
cmp word [eax], dx
je 0x4b6a36
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b6a32
mov eax, 0x10b
xor edx, edx
cmp word [ecx + 0x18], ax
pop ebp
sete dl
mov eax, edx
ret

Function at 0x4b6a60
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebx
mov edx, esp
mov eax, dword [edx + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor ebx, ebx
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
push ebp
push esi
movzx ebp, word [ecx + 6]
push edi
test ebp, ebp
jbe 0x4b6a9d
mov edi, dword [edx + 0xc]
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x4b6a95
mov ecx, dword [eax + 8]
add ecx, edx
cmp edi, ecx
jb 0x4b6a9f
inc ebx
sub eax, 0xffffffd8
cmp ebx, ebp
jb 0x4b6a85
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4b7a8b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ef1f0]
jne 0x4b7a95
repz ret
jmp 0x4c0f75
mov edi, edi
push ebp
mov dword [0x4fe700], eax
mov ebp, esp
add esp, 0xfffffcd8
mov dword [0x4fe6fc], ecx
mov dword [0x4fe6f8], edx
mov dword [0x4fe6f4], ebx
mov dword [0x4fe6f0], esi
mov dword [0x4fe6ec], edi
mov word [0x4fe718], ss
mov word [0x4fe70c], cs
mov word [0x4fe6e8], ds
mov word [0x4fe6e4], es
mov word [0x4fe6e0], fs
mov word [0x4fe6dc], gs
pushfd
pop dword [0x4fe710]
mov eax, dword [ebp]
mov dword [0x4fe704], eax
mov eax, dword [ebp + 4]
mov dword [0x4fe708], eax
lea eax, [ebp + 8]
mov dword [0x4fe714], eax
mov esi, dword [ebp - 0x320]
mov dword [0x4fe650], 0x10001
mov eax, dword [0x4fe708]
mov dword [0x4fe604], eax
mov dword [0x4fe5f8], 0xc0000409
mov dword [0x4fe5fc], 1
mov eax, dword [0x4ef1f0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4ef1f4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x4fe648], eax
push 1
call fcn.004b7a83
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x4ce43c
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x4fe648], 0
jne 0x4c1067
push 1
call fcn.004b7a83
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x4b8044
Capabilities:
Link many functions at runtime

Disassembly:
mov ebx, ebx
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push esi
push ebx
call fcn.004b5ede
and dword [ebp - 4], 0
mov ebx, eax
cmp dword [0x4fe578], 0
jne 0x4b80f5
push 0x4cd658
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
or esi, esi
je 0x4b81a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push esi
call edi
test eax, eax
je 0x4b81a6
push eax
call fcn.004b5e6c
mov dword [esp], str.GetActiveWindow
push esi
mov dword [0x4fe578], eax
call edi
push eax
call fcn.004b5e6c
mov dword [esp], str.GetLastActivePopup
push esi
mov dword [0x4fe57c], eax
call edi
push eax
call fcn.004b5e6c
mov dword [esp], str.GetUserObjectInformationW
push esi
mov dword [0x4fe580], eax
call edi
push eax
call fcn.004b5e6c
test eax, eax
pop ecx
mov dword [0x4fe588], eax
je 0x4b80f5
push str.GetProcessWindowStation
push esi
call edi
push eax
call fcn.004b5e6c
pop ecx
mov dword [0x4fe584], eax
mov eax, dword [0x4fe584]
cmp eax, ebx
je 0x4b814d
cmp dword [0x4fe588], ebx
je 0x4b814d
push eax
call fcn.004b5ee7
mov esi, eax
push dword [0x4fe588]
call fcn.004b5ee7
pop ecx
mov edi, eax
test esi, esi
pop ecx
je 0x4b814d
or edi, edi
je 0x4b814d
call esi
test eax, eax
je 0x4b8144
lea ecx, [ebp - 0x14]
lea esi, [ebp - 8]
push esi
push 0xc
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b8144
test byte [ebp - 0xc], 1
jne 0x4b814d
or dword [ebp + 0x10], 0x200000
jmp 0x4b8186
mov eax, dword [0x4fe57c]
cmp eax, ebx
je 0x4b8186
push eax
call fcn.004b5ee7
or eax, eax
pop ecx
je 0x4b8186
call eax
test eax, eax
mov dword [ebp - 4], eax
je 0x4b8186
mov eax, dword [0x4fe580]
cmp eax, ebx
je 0x4b8186
push eax
call fcn.004b5ee7
test eax, eax
pop ecx
je 0x4b8186
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4fe578]
call fcn.004b5ee7
or eax, eax
pop ecx
je 0x4b81a6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b81a8
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4bc20c
Capabilities:
Get common file path

Disassembly:
mov ebx, ebx
push ebp
mov ebp, esp
mov eax, dword [0x4ef1f0]
add esp, 0xfffffeec
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x110], 0
push edi
push esi
lea edi, [ebp - 0x10c]
mov eax, edi
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push eax
push 0x105
call esi
mov ebx, eax
cmp ebx, 0x104
jle 0x4bc28c
lea eax, [ebx + 1]
push 1
push eax
mov dword [ebp - 0x114], eax
call fcn.004b7d03
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4bc273
call fcn.004a6a4b
mov dword [eax], 0xc
xor ebx, ebx
jmp 0x4bc28c
mov dword [ebp - 0x110], 1
or ebx, ebx
je 0x4bc28c
push edi
push dword [ebp - 0x114]
call esi
mov ebx, eax
xor esi, esi
or ebx, ebx
je 0x4bc2a9
cmp byte [edi + 1], 0x3a
jne 0x4bc2b4
movzx eax, byte [edi]
push eax
call fcn.004a8e94
mov esi, eax
sub esi, 0x40
pop ecx
jmp 0x4bc2b4
call fcn.004a6a4b
mov dword [eax], 0xc
cmp dword [ebp - 0x110], 0
je 0x4bc2c4
push edi
call fcn.004a7a46
pop edi
mov eax, esi
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7a8b
leave
ret

Function at 0x4bd168
Capabilities:
Get geographical location

Disassembly:
push ebp
mov eax, dword [0x4ef1f0]
mov ebp, esp
mov edi, edi
add esp, 0xfffffff4
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
or esi, esi
je 0x4bd1d4
cmp byte [esi], 0
je 0x4bd1d4
push 0x4ce37c
push esi
call fcn.004a66b0
test eax, eax
pop ecx
pop ecx
je 0x4bd1d4
push 0x4ce378
push esi
call fcn.004a66b0
pop ecx
test eax, eax
pop ecx
jne 0x4bd1c0
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4bd1ec
lea esi, [ebp - 0xc]
push esi
call fcn.004b0ed0
pop edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b7a8b
leave
ret
push 8
lea eax, [ebp - 0xc]
push eax
push 0x1004
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
or eax, eax
jne 0x4bd1f0
xor eax, eax
jmp 0x4bd1c7
push 0x4ce374
lea eax, [ebp - 0xc]
push eax
call fcn.004a66b0
pop ecx
pop ecx
or eax, eax
jne 0x4bd1bd
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x4bd1c7
Function at 0x4bd6c1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.004b6170
mov edi, dword [ebp + 8]
mov esi, eax
add esi, 0x9c
test edi, edi
jne 0x4bd6e9
or dword [esi + 8], 0x104
jmp 0x4bd7a6
lea eax, [edi + 0x40]
lea ebx, [esi + 4]
mov dword [esi], edi
mov dword [ebx], eax
test eax, eax
je 0x4bd70c
cmp byte [eax], 0
je 0x4bd70c
push ebx
push 0x16
push 0x4ce2a8
call fcn.004bd106
add esp, 0xc
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x4bd769
cmp byte [eax], 0
je 0x4bd769
mov eax, dword [ebx]
test eax, eax
je 0x4bd72d
cmp byte [eax], 0
je 0x4bd72d
call fcn.004bd61e
jmp 0x4bd732
call fcn.004bd685
cmp dword [esi + 8], 0
jne 0x4bd7bc
push esi
push 0x40
push 0x4ce0a0
call fcn.004bd106
sub esp, 0xfffffff4
test eax, eax
je 0x4bd7b2
mov ebx, dword [ebx]
test ebx, ebx
je 0x4bd762
cmp byte [ebx], 0
je 0x4bd762
call fcn.004bd61e
jmp 0x4bd7b2
call fcn.004bd685
jmp 0x4bd7b2
mov ebx, dword [ebx]
test ebx, ebx
je 0x4bd79f
cmp byte [ebx], 0
je 0x4bd79f
push ebx
call fcn.004a7700
pop ecx
push 1
sub eax, 3
push 0x4bd27f
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [esi + 8], 4
jne 0x4bd7b2
and dword [esi + 8], 0
jmp 0x4bd7b2
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
cmp dword [esi + 8], 0
je 0x4bd8ab
mov ecx, edi
sub edi, 0xffffff80
neg ecx
sbb ecx, ecx
and ecx, edi
mov edi, esi
call fcn.004bd168
mov ebx, eax
mov dword [ebp + 8], ebx
or ebx, ebx
je 0x4bd8ab
cmp ebx, 0xfde8
je 0x4bd8ab
cmp ebx, 0xfde9
je 0x4bd8ab
movzx eax, bx
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
or eax, eax
je 0x4bd8ab
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
or eax, eax
je 0x4bd8ab
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x4bd832
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], bx
mov ebx, dword [ebp + 0x10]
or ebx, ebx
je 0x4bd8a6
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x4bd86e
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.004b7c39
add esp, 0xc
or eax, eax
je 0x4bd87f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004a633e
add esp, 0x14
jmp 0x4bd87f
push 0x40
push ebx
push 0x1001
push dword [esi + 0x18]
call edi
or eax, eax
je 0x4bd8ab
lea eax, [ebx + 0x40]
push 0x40
push eax
push 0x1002
push dword [esi + 0x1c]
call edi
or eax, eax
je 0x4bd8ab
sub ebx, 0xffffff80
push 0xa
push 0x10
push ebx
push dword [ebp + 8]
call fcn.004c3421
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4bd8ad
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c0bbc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004b5ede
mov ebx, eax
and dword [ebp - 4], 0
cmp dword [0x4fe5dc], 0
jne 0x4c0c6d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
or esi, esi
je 0x4c0d1e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ce424
push esi
call edi
or eax, eax
je 0x4c0d1e
push eax
call fcn.004b5e6c
mov dword [esp], str.GetActiveWindow
push esi
mov dword [0x4fe5dc], eax
call edi
push eax
call fcn.004b5e6c
mov dword [esp], str.GetLastActivePopup
push esi
mov dword [0x4fe5e0], eax
call edi
push eax
call fcn.004b5e6c
mov dword [esp], str.GetUserObjectInformationA
push esi
mov dword [0x4fe5e4], eax
call edi
push eax
call fcn.004b5e6c
test eax, eax
pop ecx
mov dword [0x4fe5ec], eax
je 0x4c0c6d
push str.GetProcessWindowStation
push esi
call edi
push eax
call fcn.004b5e6c
pop ecx
mov dword [0x4fe5e8], eax
mov eax, dword [0x4fe5e8]
cmp eax, ebx
je 0x4c0cc5
cmp dword [0x4fe5ec], ebx
je 0x4c0cc5
push eax
call fcn.004b5ee7
push dword [0x4fe5ec]
mov esi, eax
call fcn.004b5ee7
pop edi
pop ecx
mov edi, eax
test esi, esi
je 0x4c0cc5
test edi, edi
je 0x4c0cc5
call esi
test eax, eax
je 0x4c0cbc
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
push 0xc
push ecx
push 1
push eax
call edi
or eax, eax
je 0x4c0cbc
test byte [ebp - 0xc], 1
jne 0x4c0cc5
or dword [ebp + 0x10], 0x200000
jmp 0x4c0cfe
mov eax, dword [0x4fe5e0]
cmp eax, ebx
je 0x4c0cfe
push eax
call fcn.004b5ee7
or eax, eax
pop ecx
je 0x4c0cfe
call eax
mov dword [ebp - 4], eax
or eax, eax
je 0x4c0cfe
mov eax, dword [0x4fe5e4]
cmp eax, ebx
je 0x4c0cfe
push eax
call fcn.004b5ee7
test eax, eax
pop ecx
je 0x4c0cfe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4fe5dc]
call fcn.004b5ee7
pop ecx
test eax, eax
je 0x4c0d1e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4c0d20
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c0d2e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea ecx, [ebp - 0x10]
mov edi, edi
add esp, 0xfffffff0
push dword [ebp + 8]
call fcn.004a81e1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp byte [ebp - 4], 0
je 0x4c0d60
mov ecx, dword [ebp - 8]
and dword [ecx + 0x70], 0xfffffffd
leave
ret