joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e77e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
jne 0x100e7af
call fcn.01011b5f
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.01011b08
add esp, 0x14
or eax, 0xffffffff
jmp 0x100e82b
push esi
call fcn.0101027c
push 0x214
push 1
call fcn.010148af
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x100e813
call fcn.01010449
push dword [eax + 0x6c]
push esi
call fcn.0101030f
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
pop ecx
pop ecx
mov dword [esi + 0x54], edi
jne 0x100e7f0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x100e702
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x100e82a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
call fcn.01011bb7
cmp dword [ebp - 4], ebx
pop ecx
je 0x100e828
push dword [ebp - 4]
call fcn.01011b8f
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x100f6a2
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x1020118]
je 0x100f6c8
inc esi
cmp esi, 0x17
mov dword [ebp - 4], esi
jb 0x100f6b6
cmp esi, 0x17
jae 0x100f822
push 3
call fcn.01015de4
cmp eax, 1
pop ecx
je 0x100f7ec
push 3
call fcn.01015de4
test eax, eax
pop ecx
jne 0x100f6fb
cmp dword [0x1020100], 1
je 0x100f7ec
cmp edi, 0xfc
je 0x100f822
push 0x1004890
mov edi, 0x314
push edi
mov esi, 0x1021858
push esi
call fcn.01015d77
add esp, 0xc
test eax, eax
je 0x100f731
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
mov byte [0x1021975], bl
push 0x104
mov ebx, 0x1021871
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100f774
push 0x1004878
push 0x2fb
push ebx
call fcn.01015d77
add esp, 0xc
test eax, eax
je 0x100f774
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.01011a5d
add esp, 0x14
push ebx
push edi
push esi
call fcn.01015cfe
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x100f792
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
push 0x1001474
push edi
push esi
call fcn.01015cfe
add esp, 0xc
test eax, eax
je 0x100f7b2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x102011c]
push edi
push esi
call fcn.01015cfe
add esp, 0xc
test eax, eax
je 0x100f7d7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
push 0x12010
push 0x1004850
push esi
call fcn.01015b59
add esp, 0xc
jmp 0x100f822
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x100f822
cmp edi, 0xffffffff
je 0x100f822
mov edx, dword [esi*8 + 0x102011c]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f80b
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1014690
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x10146a3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x101469f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x10146d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x101470f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1014705
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1014711
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10146f5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1015b59
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.010101cb
xor ebx, ebx
cmp dword [0x1022134], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1015c30
push 0x1004ae4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1015b9b
xor eax, eax
jmp 0x1015cf4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1004ad8
push edi
call esi
cmp eax, ebx
je 0x1015b94
push eax
call fcn.01010160
mov dword [esp], 0x1004ac8
push edi
mov dword [0x1022134], eax
call esi
push eax
call fcn.01010160
mov dword [esp], 0x1004ab4
push edi
mov dword [0x1022138], eax
call esi
push eax
call fcn.01010160
mov dword [0x102213c], eax
lea eax, [ebp - 8]
push eax
call fcn.0100f425
test eax, eax
pop ecx
pop ecx
je 0x1015bfe
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1015c30
push 0x1004a98
push edi
call esi
push eax
call fcn.01010160
cmp eax, ebx
pop ecx
mov dword [0x1022144], eax
je 0x1015c30
push 0x1004a80
push edi
call esi
push eax
call fcn.01010160
pop ecx
mov dword [0x1022140], eax
mov eax, dword [0x1022140]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1015ca9
cmp dword [0x1022144], esi
je 0x1015ca9
push eax
call fcn.010101d9
pop ecx
call eax
cmp eax, ebx
je 0x1015c76
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1022144]
call fcn.010101d9
pop ecx
call eax
test eax, eax
je 0x1015c76
test byte [ebp - 0x18], 1
jne 0x1015ca9
lea eax, [ebp - 0xc]
push eax
call fcn.0100f466
test eax, eax
pop ecx
je 0x1015c91
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1015ca0
or dword [ebp + 0x10], 0x200000
jmp 0x1015cda
or dword [ebp + 0x10], 0x40000
jmp 0x1015cda
mov eax, dword [0x1022138]
cmp eax, esi
je 0x1015cda
push eax
call fcn.010101d9
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1015cda
mov eax, dword [0x102213c]
cmp eax, esi
je 0x1015cda
push dword [ebp - 4]
push eax
call fcn.010101d9
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1022134]
call fcn.010101d9
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101734c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1017344
dec eax
je 0x101733b
sub eax, 3
je 0x1017332
mov dword [ebp - 4], 0x40
jmp 0x1017361
mov dword [ebp - 4], 4
jmp 0x1017347
mov dword [ebp - 4], 0x20
jmp 0x1017347
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
jne 0x101734a
jne 0x101734a
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1017393
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1017313
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.01016ba4
and dword [ecx], ebx
jmp 0x10173e1
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.01016bb4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01016b69
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66

Function at 0x101779b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01016b69
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.01016ba4
stosd dword es:[edi], eax
and dword [ebp - 0x64], esp
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
Function at 0x1017832
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.01016bb4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01016b69
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.01016ba4
call 0x69334e4d
add al, 1
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1017898
cmp dword [ebp - 0x398], 0
je 0x1017a62
cmp dword [ebp + 0xc], 1
je 0x1017a62
cmp dword [ebp + 0xc], 8
jne 0x1017a2a
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
invalid
test dword [edi - 7], ecx
invalid

Function at 0x1017aad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.01016b82
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.01016bb4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01016b69
add esp, 0xc
invalid
invalid
Function at 0x101b6fa
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.0100f425
test eax, eax
pop ecx
je 0x101b72f
push edi
push edi
push edi
push edi
push edi
call fcn.01011a5d
add esp, 0x14
push 4
pop eax
call fcn.0100e850
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x101b83d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x101b7b6
push 0x1004a64
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x101b7b6
push 0x1005524
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x101b7b6
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x101b7b6
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x101b7b6
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.0101b6ce
add esp, 0xc
test eax, eax
jl 0x101b83d
not edi
and dword [ebp - 8], edi
je 0x101b7e8
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.0101b6ce
add esp, 0xc
test eax, eax
jl 0x101b83d
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x101b7f3
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x101b807
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x101b83d
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x101b83d
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x101b83d
xor eax, eax
inc eax
jmp 0x101b83f
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40915c
nop
nop
mov ecx, 0x6d922fe4
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc_1
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x475f1cd4
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x56c6e9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x56c728
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x56c728
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x56c728
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x56c728
cmp dword [ecx + 0x74], 0xe
jbe 0x56c728
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x56d9c9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x56d9ea
jl 0x56d9e1
test edi, edi
jne 0x56d9ea
xor eax, eax
xor edx, edx
jmp 0x56daab
cmp dword [ebx + 0x38], 0
je 0x56d9ff
push eax
push edi
push dword [ebp + 8]
call fcn.0056dab1
jmp 0x56daab
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x56da46
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x56da46
cmp eax, edi
jb 0x56da20
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0056eb80
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x56da4c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x56daa0
mov ecx, ebx
call fcn.0056d223
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x56da8b
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00577fef
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x56daa0
jmp 0x56da5e
test edx, edx
je 0x56daa0
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00577fef
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x57bdc8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x590240
push 0x590238
push str.FlsAlloc
push 0x1f
call fcn.0057bc33
mov esi, eax
add esp, 0x10
test esi, esi
je 0x57bdfc
push dword [ebp + 8]
mov ecx, esi
call dword [0x58c180]
call esi
jmp 0x57be02
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x57be46
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x590250
push 0x590248
push str.FlsGetValue
push 0x21
call fcn.0057bc33
mov esi, eax
add esp, 0x10
test esi, esi
je 0x57be7d
push dword [ebp + 8]
mov ecx, esi
call dword [0x58c180]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x57be85
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x590258
push 0x590250
push str.FlsSetValue
push 0x22
call fcn.0057bc33
mov esi, eax
add esp, 0x10
test esi, esi
je 0x57bebf
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x58c180]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x57f4f3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x57f590
push ebx
push esi
call fcn.0057f4bc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0057f450
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x57f53d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x57f58f
push edi
push eax
call fcn.0057cc24
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x57f55d
call fcn.0057adbb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x57f58e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0057f450
add esp, 0x20
test eax, eax
jne 0x57f57c
push edi
call fcn.0057adbb
jmp 0x57f584
push ebx
call fcn.0057adbb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5821e4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0057aad0
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x582253
cmp esi, dword [ebp - 4]
je 0x58224e
cmp dword [ebp + 0xc], 0
je 0x58224e
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x58222b
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00581d36
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x582255
xor eax, eax
inc eax
jmp 0x582255
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x5822ba
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5972c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0057aad0
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0057aad0
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x582331
cmp word [ecx], dx
je 0x582331
mov eax, dword [0x590de4]
push edi
dec eax
push eax
push 0x590cd0
call fcn.00582259
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x5823a4
cmp word [eax], dx
je 0x5823a4
mov eax, dword [edi]
test eax, eax
je 0x582355
cmp word [eax], dx
je 0x582355
lea eax, [ebp - 0x10]
push eax
call fcn.00581c3c
jmp 0x58235e
lea eax, [ebp - 0x10]
push eax
call fcn.00581cd7
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x5823ce
mov eax, dword [0x590ccc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x5909c0
call fcn.00582259
add esp, 0xc
test al, al
je 0x5823ce
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x582399
cmp word [eax], di
je 0x582399
lea eax, [ebp - 0x10]
push eax
call fcn.00581c3c
pop ecx
jmp 0x5823d0
lea eax, [ebp - 0x10]
push eax
call fcn.00581cd7
jmp 0x582396
mov eax, dword [edi]
test eax, eax
je 0x5823bb
cmp word [eax], dx
je 0x5823bb
lea eax, [ebp - 0x10]
push eax
call fcn.00581bf1
pop ecx
jmp 0x5823ce
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x582499
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.005820de
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x582499
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x582499
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x582499
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x582426
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0057bfc5
test ebx, ebx
je 0x582494
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0057bfc5
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x582499
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x582499
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00588d59
add esp, 0x10
xor eax, eax
inc eax
jmp 0x58249b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056bbc0
leave
ret