joyce8/EMBER2024-capa huggingface dataset:
Function at 0x598670
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x59870d
push ebx
push esi
call fcn.00598639
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005976fa
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5986ba
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x59870c
push edi
push eax
call fcn.0058fdae
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5986da
call fcn.0058edaa
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x59870b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005976fa
add esp, 0x20
test eax, eax
jne 0x5986f9
push edi
call fcn.0058edaa
jmp 0x598701
push ebx
call fcn.0058edaa
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x598710
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x598721
pop esi
ret
push ebx
push edi
push esi
call fcn.00598639
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0058fdae
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x598749
push ebx
push esi
push edi
call fcn.00578ab0
add esp, 0xc
push 0
call fcn.0058edaa
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x598e95
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005989bc
Function at 0x59dd80
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0059dcfc
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x59def8
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x59def8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x59dea7
jg 0x59ddd9
test eax, eax
je 0x59de9d
push 1
push 0x1000
call fcn.0058f40d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x59ddff
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x59de94
push 0x8000
push ebx
call fcn.0058d447
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x59de2b
jg 0x59de26
cmp ecx, 0x1000
jb 0x59de2b
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005928a7
add esp, 0x10
cmp eax, 0xffffffff
je 0x59de70
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x59de26
jl 0x59de57
test ecx, ecx
jne 0x59de18
push dword [ebp - 0xc]
push ebx
call fcn.0058d447
push esi
call fcn.0058edaa
add esp, 0xc
xor edi, edi
jmp 0x59df09
cmp byte [edi + 0x24], 0
je 0x59de87
cmp dword [edi + 0x20], 5
jne 0x59de87
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x59de92
mov edi, dword [edi + 0x18]
jmp 0x59de94
xor edi, edi
push esi
call fcn.0058edaa
pop ecx
jmp 0x59df09
test ecx, ecx
jg 0x59de69
jl 0x59dea7
test eax, eax
jae 0x59de69
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0059429e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x59deca
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x59de69
jmp 0x59df01
push ebx
call fcn.0059947a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x59de69
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x59df09
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x59df06
mov edi, dword [edi + 0x18]
jmp 0x59df09
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0059429e
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5a01e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5a020d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5a020d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x53b3bcc
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x18fd7749
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10005ace
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10005add
pop dword [ebp - 8]
mov eax, 0x96a7a8b4
sub eax, 0x86a74dd7
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3a35d
push 0
mov eax, 0x58885a84
sub eax, 0x488789a8
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x7e91632d
add ecx, 0x816eecc9
mov ebx, eax
mov esi, 0x10015200
add esi, dword [ebp - 8]
mov edx, 0x9a259764
xor dword [ebp - 4], 0x167430f9
mov edi, dword [esi]
xor dword [ebp - 4], ebx
sub edi, edx
sub dword [ebp - 4], ebx
mov dword [ebx], edi
sub dword [ebp - 4], 0xea39eadb
add ebx, 0x94bf71a9
add ebx, 0x6b408e5b
add esi, 0x8b90c526
sub esi, 0x8b90c522
loop 0x10005b30
add eax, 0x47077e6c
sub eax, 0x47064bc1
xor ebx, ebx
add ebx, eax
add eax, 0x6b18d5d7
sub eax, 0x6b18d5d2
mov ecx, 0xfa7af518
add ecx, 0x15850ae8
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x1000655b
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi - 0x6c]
mov ecx, esi
call fcn.10005ace
test eax, eax
jne 0x1000657b
mov eax, 0x80070005
jmp 0x100065ec
push esi
mov ecx, esi
call fcn.10005ace
test eax, eax
js 0x100065ea
cmp dword [edi + 0x44], 0
je 0x100065ea
and dword [ebp + 8], 0
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push eax
call esi
lea eax, [ebp - 8]
push eax
call esi
push 0x14
pop ecx
call fcn.100099b8
test eax, eax
je 0x100065c7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and dword [eax + 8], 0
mov dword [eax], vtable.CNameShowContactCardJob.0
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
jmp 0x100065c9
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.10005ace
mov esi, dword [ebp + 8]
test esi, esi
je 0x100065ea
mov ecx, dword [edi + 0x44]
push esi
call fcn.10005ace
test eax, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x1000ba71
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor eax, eax
inc ebx
mov esi, edx
cmp ax, word [edi]
je 0x1000baf5
push 0x10039374
push edi
call fcn.1001de79
pop ecx
pop ecx
test eax, eax
jne 0x1000baf5
push 0x100396a4
push edi
call fcn.1001de79
pop ecx
pop ecx
test eax, eax
jne 0x1000baf5
push 0x5c
pop eax
push eax
push esi
jmp 0x1000bae4
push 0x3a
pop eax
cmp ax, word [esi - 2]
je 0x1000bad9
xor eax, eax
push eax
push edi
mov word [esi], ax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000bad6
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000bad6
xor ebx, ebx
jmp 0x1000bad9
xor ebx, ebx
inc ebx
push 0x5c
pop eax
push eax
lea ecx, [esi + 2]
mov word [esi], ax
push ecx
call fcn.1001ddb2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1000baab
mov eax, ebx
jmp 0x1000baf7
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1000df5e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000df6d
pop dword [ebp - 0x4c]
mov eax, 0xd78f65ef
sub eax, 0xc78e8682
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3e810
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xc62bb332
sub ecx, 0xc62b7671
xor edx, edx
add edx, eax
mov ebx, 0x10048000
add ebx, dword [ebp - 0x4c]
mov edi, 0x9e191234
add edi, 0xff3a8bfa
mov esi, dword [ebx]
xor dword [ebp - 0x3c], eax
sub esi, edi
mov dword [ebp - 0x14], 0x9e146700
mov dword [edx], esi
add dword [ebp - 0x14], 0xd3d296d5
add edx, 4
add ebx, 4
loop 0x1000dfc3
add eax, 0xced27e47
sub eax, 0xced19870
mov ebx, eax
add eax, 0xb7c82c14
add eax, 0x4837d3f1
mov ecx, 0x9d26b1a1
sub ecx, 0x8d26b1a1
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x100194d5
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xea0
mov eax, dword [0x100400b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
jne 0x100194fb
mov eax, 0x80070057
jmp 0x1001970d
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x484]
xor ebx, ebx
push str.SoftwareMicrosoftOffice_i.0Registration
push 0x100
push eax
mov dword [esi], ebx
mov dword [ebp - 0xe9c], ebx
call fcn.1000df5e
add esp, 0x10
test eax, eax
je 0x100196fd
lea eax, [ebp - 0xe9c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x484]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100196fd
push 0x40
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0xe9c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push dword [ebp - 0xe9c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x103
je 0x100196fd
test edi, edi
jne 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x484]
mov edi, 0x100
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1000df5e
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
push 0x100393f0
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1000df5e
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1000df5e
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
lea eax, [ebp - 0xe94]
mov dword [ebp - 0xe98], ebx
push eax
push 1
push ebx
lea eax, [ebp - 0x284]
mov dword [ebp - 0xe94], ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10019655
lea eax, [ebp - 0xea0]
mov dword [ebp - 0xea0], 0x802
push eax
lea eax, [ebp - 0xe90]
push eax
lea eax, [ebp - 0xe98]
push eax
push ebx
push 0x1003b278
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 0xe94], ebx
je 0x10019669
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100196ce
cmp dword [ebp - 0xe98], 1
je 0x1001967f
cmp dword [ebp - 0xe98], 2
jne 0x100196ce
cmp dword [ebp - 0xe98], 2
jne 0x100196d2
push 0x104
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x100196d2
push 0xffffffffffffffff
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push 0x401
push eax
call fcn.1000df5e
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x1001970a
lea eax, [ebp - 0xe90]
push str._no_more_entries_
push eax
call fcn.1000df5e
pop ecx
pop ecx
test eax, eax
je 0x1001970a
xor eax, eax
cmp ax, word [ebp - 0xe90]
je 0x1001970a
lea eax, [ebp - 0xe90]
push eax
jmp 0x10019702
push str._no_more_entries_
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001c65c
leave
ret 0x10
Function at 0x68ef2285
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5c528
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ebx
mov eax, dword [edi + 4]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [esp + 0x14], eax
lea esi, [esp + 0x18]
lea eax, [esp + 0x14]
call fcn.68ef2521
mov eax, dword [eax]
cmp eax, ebx
jge 0x68ef22e4
call fcn.68ef254a
push eax
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.68f079b4
lea esi, [esp + 0x18]
lea eax, [esp + 0x14]
call fcn.68ef2521
mov ecx, dword [eax]
mov eax, dword [edi + 4]
push ecx
push dword [esp + 0x14]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov dword [esi], eax
or dword [esp + 0x28], 0xffffffff
cmp ebx, ebx
je 0x68ef232e
lea ecx, [esp + 0x10]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x68ef2e71
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0xd8]
test eax, eax
push esi
jne 0x68ef2ed3
mov ecx, dword [ecx + 0xd4]
push 2
lea eax, [ebp - 4]
push eax
push 0x100c
push ecx
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jne 0x68ef2ec3
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x68ef2eac
call esi
jmp 0x68ef2eb8
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e756c
call fcn.68f079b4
movzx eax, word [ebp - 4]
sub eax, 0x2f
cdq
push 7
pop ecx
idiv ecx
mov eax, edx
inc eax
pop esi
leave
ret

Function at 0x68ef332b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx + 0xd4]
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x100d
push ecx
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jne 0x68ef3373
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x68ef335c
call esi
jmp 0x68ef3368
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e756e
call fcn.68f079b4
movzx eax, word [ebp - 4]
sub eax, 0x30
sub eax, 0
je 0x68ef338d
dec eax
je 0x68ef3389
dec eax
jne 0x68ef338d
mov al, 4
jmp 0x68ef338f
mov al, 7
jmp 0x68ef338f
mov al, 1
pop esi
leave
ret
Function at 0x68ef6100
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 0x5a
push dword [eax]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef6161
lea eax, [esp + 0xc]
jmp 0x68ef6163
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.68f079b4
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef6194
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4

Function at 0x68ef61ba
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 6
push dword [eax]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef621b
lea eax, [esp + 0xc]
jmp 0x68ef621d
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.68f079b4
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef624e
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4
Function at 0x68ef6274
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 2
push dword [eax]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef62d5
lea eax, [esp + 0xc]
jmp 0x68ef62d7
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.68f079b4
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef6308
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4

Function at 0x68ef6340
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 7
push dword [eax]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef63a1
lea eax, [esp + 0xc]
jmp 0x68ef63a3
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.68f079b4
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef63d4
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4
Function at 0x68ef63fa
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 3
push dword [eax]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef645b
lea eax, [esp + 0xc]
jmp 0x68ef645d
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.68f079b4
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef648e
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4

Function at 0x68ef64b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 0x59
push dword [eax]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef6515
lea eax, [esp + 0xc]
jmp 0x68ef6517
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.68f079b4
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef6548
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4
Function at 0x68ef656e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d43c
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov dword [esp + 0x14], eax
mov edi, 0x80
push edi
lea eax, [esp + 0x120]
push eax
mov ebx, ecx
push 0x59
push dword [ebx]
call esi
push edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
push 0x5a
push dword [ebx]
call esi
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x230], esi
cmp dword [esp + 0x18], esi
jle 0x68ef6617
cmp eax, esi
jle 0x68ef6617
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x120]
push eax
lea eax, [esp + 0x18]
push 0x68f70e74
push eax
call fcn.68f079b4
add esp, 0x10
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [edi], eax
or dword [esp + 0x230], 0xffffffff
cmp esi, esi
je 0x68ef663a
lea ecx, [esp + 0x10]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, edi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4