joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101de6fb
Capabilities:
Enumerate files on windows

Disassembly:
push 0x4cc
mov eax, 0x10341390
call fcn.102f781d
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push ebx
mov dword [ebp - 0x2a4], esi
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], eax
call fcn.101de36d
test al, al
jne 0x101de772
cmp dword [ebx + 0x18], 8
jb 0x101de73a
mov ebx, dword [ebx + 4]
jmp 0x101de73d
add ebx, 4
push ebx
push 0x10027b74
lea eax, [ebp - 0x4d8]
push 0x22
push eax
call fcn.10161ac8
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x103495b0
lea eax, [ebp - 0x3cc]
lea edi, [ebp - 0x3cc]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.102f72b2
mov ecx, esi
call fcn.1017108a
xor edi, edi
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 7
call fcn.101610ee
push 0xffffffffffffffff
push edi
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.10161420
mov esi, 0x10003b00
push esi
lea ecx, [ebp - 0x2c]
call fcn.10161547
push 1
push eax
push ebx
mov byte [ebp - 4], 1
call fcn.101c4e8b
mov bl, al
neg bl
push edi
sbb bl, bl
push 1
lea ecx, [ebp - 0x2c]
inc bl
mov byte [ebp - 4], 0
call fcn.10161215
test bl, bl
je 0x101de7f8
push esi
lea ecx, [ebp - 0x2c]
call fcn.10161547
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.10162a70
push edi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.10161215
push 0xffffffffffffffff
push edi
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x48]
call fcn.10162a70
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x101de815
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x298]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x29c], eax
cmp eax, 0xffffffff
jne 0x101de860
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x101de93b
cmp eax, 2
je 0x101de93b
push 0x10027b3c
push eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.101b70ff
add esp, 0xc
jmp 0x101de754
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x2c]
call fcn.10162deb
push esi
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 3
call fcn.10161547
push 1
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 4
call fcn.101c4e8b
mov bl, al
neg bl
push edi
sbb bl, bl
push 1
lea ecx, [ebp - 0x2c0]
inc bl
mov byte [ebp - 4], 3
call fcn.10161215
test bl, bl
je 0x101de8da
push esi
lea ecx, [ebp - 0x2c0]
call fcn.10161547
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.10162a70
push edi
push 1
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 3
call fcn.10161215
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.101630bd
lea eax, [ebp - 0x2c]
push eax
call fcn.101c9d96
test al, al
je 0x101de905
mov ecx, dword [ebp - 0x2a4]
lea eax, [ebp - 0x2c]
push eax
call fcn.10167a6e
push edi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.10161215
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101de860
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.10161215
call fcn.102f78a0
ret 0xc
Function at 0x101e054e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jbe 0x101e057e
push esi
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x10369418]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x101e055c
pop esi
not eax
pop ebp
ret 8

Function at 0x101e1726
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.102f835e
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x101e1783
cmp dword [ebp - 0x118], 0
jne 0x101e1783
cmp word [ebp - 0xc], 2
jae 0x101e1783
xor al, al
jmp 0x101e1785
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102f77a6
leave
ret

Function at 0x101e616e
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x10342045
call fcn.102f781d
mov esi, dword [ebp + 8]
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.101e4b0c
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jne 0x101e619b
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.101cdfa0
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x101e61a7
lea eax, [ebp - 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x101e620e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x38], eax
call fcn.101c5069
test al, al
je 0x101e61f5
cmp dword [esi + 0x18], 8
jb 0x101e61d9
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
jmp 0x101e61df
add esi, 4
mov dword [ebp - 0x34], esi
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x1002bf70
push 2
call fcn.101e22ab
mov byte [ebp - 0x2d], bl
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10161215
mov al, byte [ebp - 0x2d]
call fcn.102f78a0
ret 4
call fcn.101c5069
test al, al
je 0x101e623d
cmp dword [esi + 0x18], 8
jb 0x101e6225
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
jmp 0x101e622b
add esi, 4
mov dword [ebp - 0x34], esi
push ebx
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x1002bf00
push 3
call fcn.10162203
mov byte [ebp - 0x2d], 1
jmp 0x101e61f8
Function at 0x101e62a6
Capabilities:
Check if file exists

Disassembly:
push 0x3c
mov eax, 0x10342072
call fcn.102f781d
mov edi, dword [ebp + 8]
push edi
call fcn.101e5e6a
mov dword [ebp - 0x38], eax
push edi
lea eax, [ebp - 0x2c]
push eax
mov esi, edx
call fcn.101e4c3d
mov eax, dword [ebp - 0x28]
xor edi, edi
cmp dword [ebp - 0x14], 8
mov dword [ebp - 4], edi
jae 0x101e62db
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x101e6319
call fcn.101c5069
test al, al
je 0x101e640c
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x101e62ff
lea eax, [ebp - 0x28]
push edi
push edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x1002c168
push 3
call fcn.10180836
jmp 0x101e640c
lea eax, [ebp - 0x2c]
push eax
call fcn.101cc161
mov edi, edx
mov ebx, eax
cmp edi, esi
jb 0x101e63bb
ja 0x101e6339
cmp ebx, dword [ebp - 0x38]
jb 0x101e63bb
call fcn.101c5069
test al, al
je 0x101e638a
mov eax, dword [ebp - 0x28]
shrd ebx, edi, 0x14
shr edi, 0x14
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
jae 0x101e635b
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
shrd eax, esi, 0x14
push 0
push 0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x1002c0c8
shr esi, 0x14
push 3
mov dword [ebp - 0x34], esi
call fcn.101e28b6
call fcn.101c5069
test al, al
je 0x101e63a3
push 0
push 0
push 0x1002c060
push 3
call fcn.101e21b5
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10161215
mov al, bl
call fcn.102f78a0
ret 4
call fcn.101c5069
test al, al
je 0x101e640c
mov eax, dword [ebp - 0x28]
shrd ebx, edi, 0x14
shr edi, 0x14
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
jae 0x101e63dd
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
shrd eax, esi, 0x14
push 0
push 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x1002c0c8
shr esi, 0x14
push 3
mov dword [ebp - 0x44], esi
call fcn.101e28b6
call fcn.101c5069
test al, al
je 0x101e6425
push 0
push 0
push 0x1002bff8
push 2
call fcn.101e21b5
xor bl, bl
jmp 0x101e63a5
Function at 0x101e642c
Capabilities:
Check if file exists

Disassembly:
push 0x3c
mov eax, 0x10342072
call fcn.102f781d
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.101e5faa
mov dword [ebp - 0x38], eax
push edi
lea eax, [ebp - 0x2c]
push eax
mov esi, edx
call fcn.101e4c3d
mov eax, dword [ebp - 0x28]
xor edi, edi
cmp dword [ebp - 0x14], 8
mov dword [ebp - 4], edi
jae 0x101e6465
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x101e64a3
call fcn.101c5069
test al, al
je 0x101e6596
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x101e6489
lea eax, [ebp - 0x28]
push edi
push edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x1002c168
push 3
call fcn.10180836
jmp 0x101e6596
lea eax, [ebp - 0x2c]
push eax
call fcn.101cc161
mov edi, edx
mov ebx, eax
cmp edi, esi
jb 0x101e6545
ja 0x101e64c3
cmp ebx, dword [ebp - 0x38]
jb 0x101e6545
call fcn.101c5069
test al, al
je 0x101e6514
mov eax, dword [ebp - 0x28]
shrd ebx, edi, 0x14
shr edi, 0x14
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
jae 0x101e64e5
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
shrd eax, esi, 0x14
push 0
push 0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x1002c2b8
shr esi, 0x14
push 3
mov dword [ebp - 0x34], esi
call fcn.101e291a
call fcn.101c5069
test al, al
je 0x101e652d
push 0
push 0
push 0x1002c238
push 3
call fcn.101e225c
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10161215
mov al, bl
call fcn.102f78a0
ret 8
call fcn.101c5069
test al, al
je 0x101e6596
mov eax, dword [ebp - 0x28]
shrd ebx, edi, 0x14
shr edi, 0x14
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
jae 0x101e6567
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
shrd eax, esi, 0x14
push 0
push 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x1002c2b8
shr esi, 0x14
push 3
mov dword [ebp - 0x44], esi
call fcn.101e291a
call fcn.101c5069
test al, al
je 0x101e65af
push 0
push 0
push 0x1002c1b8
push 2
call fcn.101e225c
xor bl, bl
jmp 0x101e652f
Function at 0x101ed2dc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp ax, word [0x103a50b6]
je 0x101ed36e
push esi
push edi
movzx esi, ax
lea eax, [ebp - 0x20]
push eax
xor edi, edi
push esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
call fcn.101fa7d6
test eax, eax
jl 0x101ed350
mov eax, dword [ebp - 0x20]
push edi
push edi
push 0xa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0x81
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call fcn.101fbd97
test eax, eax
je 0x101ed350
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101f082b
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jl 0x101ed35c
cmp eax, 3
jle 0x101ed35e
xor eax, eax
shl esi, 0x10
and eax, 3
or esi, eax
pop edi
mov dword [0x103a50b4], esi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x103a50b4]
xor ecx, ebp
and eax, 3
call fcn.102f77a6
leave
ret
Function at 0x101f4f9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0x20]
push edi
test bl, 8
je 0x101f4fdc
cmp dword [esp + 0x20], 1
jge 0x101f4fcc
push 0
push 0x1003de80
push 0x7176667a
push 0x1003de80
call fcn.102d79fc
pop edi
or eax, 0xffffffff
pop ebx
ret 0x20
mov edi, dword [esp + 0x1c]
test bl, 1
je 0x101f501b
xor eax, eax
mov word [edi], ax
jmp 0x101f501e
cmp dword [esp + 0x20], 2
jge 0x101f5001
push 0
push 0x1003de80
push 0x64616c77
push 0x1003de80
call fcn.102d79fc
pop edi
or eax, 0xffffffff
pop ebx
ret 0x20
mov edi, dword [esp + 0x1c]
test bl, 1
je 0x101f5017
xor ecx, ecx
xor edx, edx
mov word [edi + 2], cx
mov word [edi], dx
jmp 0x101f501e
mov byte [edi + 1], 0
mov byte [edi], 0
push ebp
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.101f53d2
test eax, eax
jne 0x101f5060
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 1]
movzx ecx, ax
push 0xd9
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x101f5060
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x101f5060
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x101f506a
pop esi
pop ebp
pop edi
or eax, 0xffffffff
pop ebx
ret 0x20
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
push edx
push ebx
push ecx
movzx ecx, word [esp + 0x2c]
movzx edx, bp
push edi
shl edx, 0x10
or edx, ecx
push edx
mov edx, dword [esp + 0x28]
push eax
push esi
push edx
call fcn.101f4aa3
pop esi
pop ebp
pop edi
pop ebx
ret 0x20

Function at 0x101f5f0c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x101f5fdf
cmp dword [ebp - 0x90], 2
mov ecx, dword [ebp - 0x98]
mov al, byte [ebp - 6]
push esi
mov dword [0x103a5940], ecx
mov byte [0x103a5946], al
jne 0x101f5fcb
mov eax, dword [ebp - 0x9c]
mov dx, word [ebp - 0xc]
mov dword [0x103a593c], eax
mov word [0x103a5944], dx
cmp eax, 5
jne 0x101f5fad
mov esi, 0x1003de80
cmp ecx, 1
jae 0x101f5f8f
push 0
push esi
push 0x3535796e
push esi
call fcn.102d79fc
cmp dword [ebp - 0x98], 1
jne 0x101f5fad
cmp word [ebp - 0xc], 1
ja 0x101f5fad
push 0
push esi
push 0x3535796f
push esi
call fcn.102d79fc
movzx eax, word [ebp - 8]
mov ecx, eax
and ecx, 0x110
and eax, 0x100
mov dword [0x103a594c], ecx
mov dword [0x103a5950], eax
jmp 0x101f5fde
push 0
mov esi, 0x1003de80
push esi
push 0x31343461
push esi
call fcn.102d79fc
pop esi
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
xor ecx, ebp
mov dword [0x103a5948], eax
call fcn.102f77a6
leave
ret

Function at 0x101f60db
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x101f60f5
test al, 0x10
je 0x101f60f5
xor eax, eax
inc eax
jmp 0x101f60f7
xor eax, eax
pop ebp
ret 4
Function at 0x101f6193
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1003e008
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101f6209
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0x1003dfec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f6200
cmp dword [ebp - 8], 1
jne 0x101f6200
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x1003dfe0
call esi
test eax, eax
jne 0x101f61fd
push 0x1003dfcc
call esi
test eax, eax
je 0x101f6200
xor edi, edi
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x101f620f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x224], esi
call fcn.101f600c
test eax, eax
je 0x101f632a
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
mov ebx, 0x1003e088
push ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
jne 0x101f6328
lea eax, [ebp - 0x214]
push eax
push 0x20119
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x101f631c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov edi, 0x1003e074
push edi
push dword [ebp - 0x218]
mov ebx, 0x20a
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x101f6310
cmp dword [ebp - 0x21c], 1
jne 0x101f6310
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x101f6310
xor esi, esi
inc esi
cmp dword [ebp - 0x21c], esi
jne 0x101f6310
call fcn.101f6193
test eax, eax
jne 0x101f6310
mov dword [ebp - 0x224], esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
xor ecx, ebp
pop esi
call fcn.102f77a6
leave
ret
Function at 0x101f7ec5
Capabilities:
Check if file exists
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push 0x103a5a64
mov dword [ebp - 4], 0x80004005
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [0x103a5a7c], ebx
je 0x101f7ef3
mov dword [ebp - 4], 0x100001
jmp 0x101f7f88
mov ecx, dword [ebp + 8]
cmp ecx, ebx
jne 0x101f7f06
mov dword [ebp - 4], 0x8ff00003
jmp 0x101f7f88
mov eax, dword [ecx]
mov dword [0x103a5960], eax
mov eax, dword [ecx]
push esi
push edi
cmp eax, ebx
jne 0x101f7fa2
cmp dword [ecx + 4], ebx
je 0x101f7f81
mov eax, dword [ecx + 0x10]
mov dword [0x103a5a60], eax
mov eax, dword [ecx + 8]
mov dword [0x1039a56c], eax
mov eax, dword [ecx + 0xc]
push 1
push ebx
mov dword [fcn.1020385f], eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x103a5964], eax
cmp eax, ebx
jne 0x101f7f9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x101f7f81
cmp eax, 3
jbe 0x101f7f7a
cmp eax, 0x1f
je 0x101f7f7a
cmp eax, 0x7e
je 0x101f7f7a
cmp eax, 0xc1
je 0x101f7f7a
cmp eax, 0x3ee
je 0x101f7f7a
cmp eax, 0x485
jne 0x101f7f81
mov dword [ebp - 4], 0x8ff00004
call fcn.101f78e2
pop edi
pop esi
push 0x103a5a64
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
mov ecx, 0x315
jmp 0x101f7fcb
cmp eax, 1
jne 0x101f7f86
mov eax, dword [ecx + 0x14]
mov dword [0x103a5a60], eax
mov eax, dword [ecx + 0xc]
mov dword [0x1039a56c], eax
mov eax, dword [ecx + 0x10]
mov dword [fcn.1020385f], eax
mov eax, dword [ecx + 4]
mov dword [0x103a5964], eax
movzx ecx, word [ecx + 8]
cmp dword [0x1039a56c], ebx
je 0x101f7f81
cmp dword [fcn.1020385f], ebx
je 0x101f7f81
movzx ecx, cx
push 0xa
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x101f7f81
push edi
push dword [0x103a5964]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, 6
jb 0x101f7f81
push edi
push dword [0x103a5964]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x101f7f81
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esi + eax]
mov dword [0x103a5a2c], ecx
mov cx, word [0x1003fe7c]
mov dword [0x103a5a28], eax
cmp cx, word [eax]
jne 0x101f7f81
add eax, 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.101f6cee
cmp esi, dword [ebp - 8]
jne 0x101f7f81
lea eax, [ebp + 8]
push eax
call fcn.101f7ddd
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x101f7f81
call fcn.101f7b09
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x101f7f81
push 7
pop ecx
xor eax, eax
mov edi, 0x103a5974
rep stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
mov dword [0x103a5a7c], 1
jmp 0x101f7f86
Function at 0x101f98b2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x103a5a64
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [esi + 0x1f], 2
jne 0x101f9ac7
mov eax, dword [esi + 0x14]
push edi
mov edi, 0x103a5aa0
cmp eax, ebx
je 0x101f9908
push eax
mov ecx, edi
call fcn.101fc352
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x101f9a09
lea eax, [ebp - 0x23c]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x1003fe68
push ebx
call fcn.101f7c44
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x101f9a09
mov eax, dword [ebp - 0x238]
push 4
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or eax, ecx
push eax
mov ecx, edi
call fcn.101fc328
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x101f9a19
mov dword [ebp - 0x21c], ebx
cmp dword [ebp - 0x238], ebx
jbe 0x101f99dd
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x23c]
push dword [eax + ecx*4]
call fcn.101f9481
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x101f99c2
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x224]
mov dword [ecx + eax*4], edx
inc byte [esi + 0x1d]
jmp 0x101f99c9
cmp eax, 0x8007000e
je 0x101f99f4
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x238]
jb 0x101f9988
cmp byte [esi + 0x1d], bl
jne 0x101f9ab3
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
jmp 0x101f9ab3
push dword [esi + 0x14]
mov ecx, edi
call fcn.101fc352
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
jmp 0x101f9ac6
push 4
mov ecx, edi
call fcn.101fc328
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x101f9a28
mov dword [ebp - 0x218], 0x8007000e
jmp 0x101f9ac6
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
call fcn.101fc54f
test al, al
je 0x101f9a58
cmp dword [esi + 8], 0x1000
jne 0x101f9a58
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 4]
call fcn.101fc4f2
jmp 0x101f9a6f
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x101f9ab3
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x21c], ebx
call fcn.101f83d9
test eax, eax
je 0x101f9aa7
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.101fc19f
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x101f9ac6
cmp dword [esi + 8], 0xc00
je 0x101f9ac0
or byte [esi + 0x1f], 2
mov dword [ebp - 0x218], ebx
pop edi
push 0x103a5a64
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], ebx
pop esi
pop ebx
je 0x101f9ae8
lea eax, [ebp - 0x23c]
push eax
call fcn.101f7cb1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.102f77a6
leave
ret 4
Function at 0x101fa48a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x103a5a7c], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x101fa4b3
mov edi, 0x8ff000ff
jmp 0x101fa4f8
test ebx, ebx
je 0x101fa4f3
call fcn.101f9890
mov edi, eax
test edi, edi
jl 0x101fa4f8
push esi
call fcn.101f6f90
mov esi, eax
test esi, esi
je 0x101fa4f3
test byte [esi + 0x1f], 4
jne 0x101fa4ea
push esi
call fcn.101f910b
mov edi, eax
test edi, edi
jge 0x101fa4ea
cmp edi, 0x8007000e
je 0x101fa4f8
xor edi, edi
mov eax, dword [ebp + 0xc]
dec eax
je 0x101fa50b
dec eax
je 0x101fa523
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x101fa523
cmp byte [esi + 0x1e], 0
jbe 0x101fa523
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x101fa4f8
cmp dword [esi + 8], 0x1000
jne 0x101fa54a
call fcn.101fc54f
test al, al
je 0x101fa54a
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 4]
call fcn.101fc4f2
jmp 0x101fa55e
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x101fa4f3
lea eax, [ebp - 0xc]
push eax
call fcn.101f8338
push ebx
push eax
call fcn.101f983a
mov edi, eax
jmp 0x101fa4f8