joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431caa
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x431d54
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x431d33
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x431d0f
mov byte [ebp - 1], 0
push 0x733f
push 0
push 1
lea eax, [ebp - 1]
push eax
push 0x3638
push 1
push 0x2b52
call fcn.004335f6
add esp, 0x1c
jmp 0x431d31
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x431d31
push 0xfc0
push 0x253a
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x431d52
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x5bcc
push 1
push 0x28eb
push 0
push dword [ebp - 0x18]
call fcn.00437dc9
add esp, 0x14
jmp 0x431d93
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
push 1
push dword [ebp - 0x1c]
push 0x379e
push 0x986
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
push eax
push 0x6c36
push 0
push 0x4f65
push dword [ebp - 0x24]
call fcn.00468a67
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x43803a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdc6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4381de
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4380ac
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0
push 0x7467
push 0x300b
call fcn.0046edf6
add esp, 0x10
jmp 0x4381dc
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x4380e7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x4380e2
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x4381dc
mov dword [ebp - 0x24], 0x609
mov dword [ebp - 0x4c], str.bwmzitdms_epxwzu_heo_kpazcojnf_kjfgziama_fgi_onrubhd
cmp dword [ebp - 0x24], 0x77f
jle 0x438183
and dword [ebp - 0x20], 0
jmp 0x43810f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5f14
jge 0x438183
and dword [ebp - 0x18], 0
jmp 0x438125
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1fc5
jge 0x438181
and dword [ebp - 0x1c], 0
jmp 0x43813b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xd57
jge 0x43817f
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
and edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.004019d8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040bba0
push eax
call fcn.004b7f67
pop ecx
lea ecx, [ebp - 0x74]
call fcn.0040bb96
jmp 0x438134
jmp 0x43811e
jmp 0x438108
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x4381a0
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3c4
jge 0x4381b6
push dword [ebp - 0x4c]
call fcn.004b7f67
pop ecx
jmp 0x4381d2
or dword [ebp - 4], 0xffffffff
jmp 0x4381dc
jmp 0x438218
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
push 0x299
push 0
push 0x58b3
push 0x61f3
push 0x5562
push 0x3459
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0x6b58
call fcn.0044269a
add esp, 0x24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ca6a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43cb56
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43cb27
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43cada
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x43cb25
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43cb08
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x43cb25
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0040bec0
mov dword [eax], 5
jmp 0x43cafd
jmp 0x43cb54
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x100c
push dword [ebp - 0x38]
push 1
push dword [ebp - 0x3c]
push 0x76ca
push 0x4674
push 0
call fcn.0046ec9c
add esp, 0x1c
jmp 0x43cb68
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
push 1
push dword [ebp - 0x40]
call fcn.00422dfe
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x452b62
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x452bec
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x452ba0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 1
call fcn.00452c27
pop ecx
pop ecx
jmp 0x452bea
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x452bd9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x452bd7
push 0xe84
push 0
push 0x7b9c
push 0
push 0x2766
call fcn.00437dc9
add esp, 0x14
jmp 0x452bea
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x452c23
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
push eax
push 0x2a9
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
call fcn.0041ea4e
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4534ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cded1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x45355a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x2e6b
push 1
call fcn.004536dc
add esp, 0x1c
jmp 0x4536cb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4535ac
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
push 0
push 0x2b5a
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x5ed0
push 0xbec
call fcn.0042ba32
add esp, 0x18
jmp 0x4536cb
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], 0x3c1b
mov dword [ebp - 0x50], str.nwfhbqgg_ujfqv_hdvt_zahpoxma_hsoy_cozijv_frf_ueurnptzf_gmwqnlyf
cmp dword [ebp - 0x1c], 0x3f28
jle 0x453638
and dword [ebp - 0x14], 0
jmp 0x4535d6
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7aef
jge 0x45362e
and dword [ebp - 0x18], 0
jmp 0x4535ec
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1689
jge 0x45362c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.004019d8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040bba0
push eax
call fcn.004b7f67
pop ecx
lea ecx, [ebp - 0x70]
call fcn.0040bb96
jmp 0x4535e5
jmp 0x4535cf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0x7df0
push 0x3aa
push 0
push 0x3b6f
push 0x4285
push 0
push 0x6772
push 0x4359
push 0x34e4
push 0x7c8b
push 0x161e
push 0x35fc
push 1
push 0x5680
push 0x393c
push dword [ebp - 0x4c]
push 0x29af
push 0xd74
call fcn.0043038d
add esp, 0x48
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3c0d
jge 0x4536a5
push dword [ebp - 0x50]
call fcn.004b7f67
pop ecx
jmp 0x4536c1
or dword [ebp - 4], 0xffffffff
jmp 0x4536cb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45722c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdf35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 2
lea ecx, [ebp - 0x54]
call fcn.0040bdd2
mov dword [ebp - 0x24], 0x57e3b6f9
mov dword [ebp - 0x30], 0xedc0
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0x85d0
push 0x7f36
push 0x4a4a
push 1
lea eax, [ebp - 0x54]
push eax
push 1
lea eax, [ebp - 0x40]
push eax
push 1
push 0xf21
push 0xb15
push 1
push 1
push 0x1585
call fcn.0043a8a4
add esp, 0x30
push 0
lea eax, [ebp - 0x2c]
push eax
push 0x3af8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0046add2
add esp, 0x1c
push 1
lea eax, [ebp - 0x38]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push 1
push 0x41c7
push 1
push 0x1348
push 0x4e34
push 0x7031
call fcn.0043adfa
add esp, 0x28
lea ecx, [ebp - 0x54]
call fcn.0040bea4
mov dword [ebp - 0x28], 0x3102
mov dword [ebp - 0x3c], str.awc_acegucpt_aqrnlg_vgqiqpjt_izizhkks_eyrls_bqxen_kuchaogbm_zyxnozxmu_lnryhcux_xgzvseq_lfdwsieu_abxs_gozanmhfn
cmp dword [ebp - 0x28], 0x33d8
jle 0x4573af
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
and dword [ebp - 0x1c], 0
jmp 0x457337
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x15ca
jge 0x4573af
and dword [ebp - 0x14], 0
jmp 0x45734d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3854
jge 0x4573ad
and dword [ebp - 0x18], 0
jmp 0x457363
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1ea5
jge 0x4573ab
and dword [ebp - 0x20], 0
jmp 0x457379
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6e53
jge 0x4573a9
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
or eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x457372
jmp 0x45735c
jmp 0x457346
jmp 0x457330
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x309a
jge 0x4573c9
mov edx, dword [ebp - 0x3c]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x4573e5
or dword [ebp - 4], 0xffffffff
jmp 0x4573ef
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ed8b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdfb7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x7b3b
mov dword [ebp - 0x24], str.tapse_qbbalv_lvnk_twqabsv_wwg
cmp dword [ebp - 0x20], 0x7d64
jle 0x45ee41
and dword [ebp - 0x14], 0
jmp 0x45edd1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xafa
jge 0x45ee2f
and dword [ebp - 0x18], 0
jmp 0x45ede7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4f26
jge 0x45ee2d
and dword [ebp - 0x1c], 0
jmp 0x45edfd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5fc5
jge 0x45ee2b
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
and edx, dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x45edf6
jmp 0x45ede0
jmp 0x45edca
push 0x9e3
push 0
push 0x8d
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebp + 0x14]
push 0x1b0a
push dword [ebp + 0xc]
push 0x67e7
push dword [ebp + 0x10]
push 1
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.0045eeb5
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x78d0
jge 0x45ee7e
mov edx, dword [ebp - 0x24]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x45ee9a
or dword [ebp - 4], 0xffffffff
jmp 0x45eea4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468f8f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x469050
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x46902b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x6a0a
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 1
push dword [ebp - 0x40]
call fcn.0046910d
add esp, 0x24
jmp 0x46904b
push 0xa6
push 1
push 0xc3d
push 0x7abb
push 1
push 0x23ad
call fcn.00423472
add esp, 0x18
jmp 0x469109
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x4690c6
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x4690a7
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax]
and dword [eax + 0xc], 0
jmp 0x4690c4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4690c4
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x469109
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
push 0x59fa
push dword [ebp - 0x68]
push 0x47e2
push 0x5d25
push 1
push 0
push 1
push 0x1a55
push 0x2e0c
push 0x3eed
push dword [ebp - 0x6c]
push 0x679f
call fcn.0044deb6
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x46f149
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce0b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x46f269
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x2716
mov dword [ebp - 0x24], str.xgmfu_fialc_bencwky_uwisfds_nyojxpk_byy_vslih_zynquml_mhuapli_jkogxje_zpqhany_gksuagd_rfcxz_hyurw
cmp dword [ebp - 0x20], 0x2a99
jle 0x46f208
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and dword [ebp - 0x14], 0
jmp 0x46f1a9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2820
jge 0x46f208
and dword [ebp - 0x18], 0
jmp 0x46f1bf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x306a
jge 0x46f206
and dword [ebp - 0x1c], 0
jmp 0x46f1d5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3ab0
jge 0x46f204
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
imul edx, dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x46f1ce
jmp 0x46f1b8
jmp 0x46f1a2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x269c
jge 0x46f228
mov edx, dword [ebp - 0x24]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x46f244
or dword [ebp - 4], 0xffffffff
jmp 0x46f24e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.0046f2ad
add esp, 0x10
jmp 0x46f29c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push 0x7748
push 1
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
push 0x1174
call fcn.0046e31b
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473a43
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
movzx eax, byte [ebp + 8]
test eax, eax
je 0x473a83
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
push 0x12a4
push dword [ebp - 0x30]
push 0
push 0xea7
call fcn.0048bdc9
add esp, 0x14
jmp 0x473c06
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x3eb60693
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x14], 0
jmp 0x473abb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x473ad1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], 0xa167c28c
jmp 0x473ab4
cmp dword [ebp - 8], 1
jae 0x473ae0
mov dword [ebp - 0x1c], 1
jmp 0x473ae4
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1c], eax
je 0x473af5
mov dword [ebp - 0x28], 1
jmp 0x473af9
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jle 0x473b0d
mov dword [ebp - 0x20], 1
jmp 0x473b11
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0xcd45
jg 0x473b23
mov dword [ebp - 0x24], 1
jmp 0x473b27
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x24], eax
jle 0x473b51
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x473b4c
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x473bf4
mov dword [ebp - 0x38], 0xfffe
push 3
lea ecx, [ebp - 0x64]
call fcn.0040bdd2
or dword [ebp - 0x54], 0xffffffff
or dword [ebp - 0x50], 0xffffffff
or dword [ebp - 0x4c], 0xffffffff
or dword [ebp - 0x48], 0xffffffff
lea ecx, [ebp - 0x15]
call fcn.0040becf
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x84]
call fcn.0040bed2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7c]
call fcn.0040be7e
mov dword [ebp - 0x10], 0
jmp 0x473bab
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x473bc1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x64]
call fcn.0040bec0
and dword [eax], 0
jmp 0x473ba4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x70], eax
xor eax, eax
neg eax
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x7c]
call fcn.0040bea4
lea ecx, [ebp - 0x64]
call fcn.0040bea4
push 0
push dword [ebp - 0x34]
push 1
push dword [ebp - 0x40]
call fcn.00476887
add esp, 0x10
mov esp, ebp
pop ebp
ret