joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059ac0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x10059be1
mov edx, dword [ebp + 0x14]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
inc eax
sub eax, esi
mov dword [ebp + 8], eax
push 2
pop eax
sub eax, esi
mov dword [ebp - 4], eax
lea eax, [esi + edi]
movzx eax, byte [eax]
shr eax, 2
movzx ecx, byte [eax + 0x10059be8]
mov eax, dword [edx]
mov word [eax], cx
mov eax, dword [ebp + 8]
add dword [edx], 2
lea ecx, [esi + edi]
add eax, ecx
cmp eax, ebx
je 0x10059bad
mov al, byte [ecx]
and al, 3
shl al, 4
movzx ecx, al
movzx eax, byte [edi + esi + 1]
shr eax, 4
or ecx, eax
movzx eax, byte [ecx + 0x10059be8]
mov ecx, dword [edx]
mov word [ecx], ax
mov eax, dword [ebp - 4]
add dword [edx], 2
lea ecx, [esi + edi]
add eax, ecx
cmp eax, ebx
mov al, byte [edi + esi + 1]
je 0x10059b89
and al, 0xf
shl al, 2
movzx ecx, al
movzx eax, byte [edi + esi + 2]
shr eax, 6
or ecx, eax
movzx eax, byte [ecx + 0x10059be8]
mov ecx, dword [edx]
mov word [ecx], ax
add dword [edx], 2
movzx eax, byte [edi + esi + 2]
mov ecx, dword [edx]
and eax, 0x3f
movzx eax, byte [eax + 0x10059be8]
mov word [ecx], ax
add dword [edx], 2
add edi, 3
cmp edi, ebx
jae 0x10059be0
jmp 0x10059aea
mov ecx, dword [edx]
and al, 0xf
shl al, 2
movzx eax, al
movzx eax, byte [eax + 0x10059be8]
mov word [ecx], ax
add dword [edx], 2
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x10059be0
push 0x3d
pop ecx
jmp 0x10059bda
mov al, byte [edi + esi]
mov ecx, dword [edx]
and al, 3
shl al, 4
movzx eax, al
movzx eax, byte [eax + 0x10059be8]
mov word [ecx], ax
add dword [edx], 2
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x10059be0
push 0x3d
pop ecx
mov word [eax], cx
add dword [edx], 2
mov eax, dword [edx]
mov word [eax], cx
add dword [edx], 2
pop esi
pop edi
pop ebx
leave
ret 0x10

Function at 0x1005a579
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1005a5f0
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005a5de
lea eax, [esi + esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
push ebx
push 0x1005a65c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret
Function at 0x1005a66e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1005a7b3
and dword [ebp - 0x47c], eax
push ebx
push esi
push edi
lea edi, [ebp - 0x478]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x46c], 0xc
lea edi, [ebp - 0x468]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x45c]
push 0
push eax
mov dword [ebp - 0x460], 0x44
call sub.MSVCR100.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor eax, eax
mov esi, 0x208
push esi
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push esi
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
mov ecx, 0x105
lea edi, [ebp - 0x41c]
call fcn.1005a579
test eax, eax
je 0x1005a7b0
xor edi, edi
push edi
xor eax, eax
inc eax
push edi
push eax
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x46c]
push eax
mov dword [ebp - 0x468], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x1005a7b0
push esi
push ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1005a7bf
add esp, 0x10
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x460]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1005a7ad
push dword [ebp - 0x47c]
call edi
push dword [ebp - 0x478]
call edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002069
leave
ret
Function at 0x1005b8a6
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x248
mov eax, 0x100d4922
call fcn.1000240f
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
push eax
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], eax
call fcn.1004c517
lea eax, [ebp - 0x254]
push eax
mov byte [ebp - 4], 1
call fcn.1005bc6c
xor ecx, ecx
mov esi, ecx
mov edi, dword [ebp - 0x254]
lea eax, [ebp - 0x244]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push edi
mov dword [ebp - 0x220], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
mov dword [ebp - 0x248], esi
cmp eax, 0x103
jne 0x1005b939
push 0x80004005
push 0x2e6e3162
jmp 0x1005b957
test eax, eax
je 0x1005b95c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1005b951
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e3163
call fcn.10042515
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x22c], edi
call fcn.10006a82
push 0x20019
lea ecx, [ebp - 0x23c]
call fcn.10006b9b
push eax
lea ecx, [ebp - 0x23c]
call fcn.10006c72
push ebx
lea eax, [ebp - 0x23c]
push eax
call fcn.1005ba76
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
push 0
pop ecx
cmp eax, dword [edx]
jne 0x1005b8f5
lea eax, [edx + 4]
cmp word [eax], cx
je 0x1005b9f4
lea ecx, [ebx + 4]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1005b9e0
test dx, dx
je 0x1005b9da
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1005b9e0
add ecx, 4
add eax, 4
test dx, dx
jne 0x1005b9b8
xor ecx, ecx
mov eax, ecx
jmp 0x1005b9e7
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
jne 0x1005b8f5
mov byte [ebp - 4], cl
jmp 0x1005ba58
mov eax, dword [ebx + 0x54]
cmp eax, dword [edx + 0x54]
jne 0x1005b8f5
mov eax, dword [ebx + 0xa8]
cmp eax, dword [edx + 0xa8]
jne 0x1005b8f5
push 4
pop ecx
xor eax, eax
lea edi, [edx + 0x44]
lea esi, [ebx + 0x44]
repe cmpsd dword [esi], dword es:[edi]
mov esi, dword [ebp - 0x248]
mov edi, dword [ebp - 0x254]
push eax
pop ecx
jne 0x1005b8f5
push 4
pop ecx
lea edi, [edx + 0x98]
lea esi, [ebx + 0x98]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x1005ba55
mov esi, dword [ebp - 0x248]
xor ecx, ecx
jmp 0x1005b8ef
mov byte [ebp - 4], al
lea ecx, [ebp - 0x23c]
call fcn.1000856c
lea ecx, [ebp - 0x254]
call fcn.10006c5f
call fcn.10002550
ret 8
Function at 0x1006e582
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
or ebx, 0xffffffff
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea esi, [edi + 0x24]
push esi
mov dword [ebp - 8], eax
mov byte [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
cmp dword [edi + 0x60], eax
je 0x1006e5d1
lea ecx, [edi + 0x74]
cmp byte [ecx], al
je 0x1006e5d1
lea eax, [ebp - 0xc]
push eax
call fcn.100514ec
mov ebx, eax
xor eax, eax
test ebx, ebx
jg 0x1006e5cd
mov ebx, eax
mov byte [ebp - 1], 1
cmp dword [ebp + 8], 0xffffffff
je 0x1006e5e7
cmp ebx, 0xffffffff
je 0x1006e5e1
cmp dword [ebp + 8], ebx
jge 0x1006e5e7
mov ebx, dword [ebp + 8]
mov byte [ebp - 1], al
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
jne 0x1006e602
mov ecx, dword [edi + 0x9c]
call fcn.1002d7fa
mov bl, 1
jmp 0x1006e62f
cmp byte [ebp - 1], 0
je 0x1006e617
test ebx, ebx
jne 0x1006e617
cmp byte [edi + 0x3d], bl
je 0x1006e617
xor ecx, ecx
mov bl, cl
jmp 0x1006e62f
mov ecx, dword [edi + 0x9c]
push ebx
lea eax, [ebp + 0xa]
push eax
call fcn.1002d81c
xor ecx, ecx
cmp word [eax], cx
setne bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x14], 1
call fcn.100514ec
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
test bl, bl
je 0x1006e667
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
mov byte [edi + 0x3d], 1
push dword [ebp + 0xc]
call fcn.1006e2f2
jmp 0x1006e67f
xor eax, eax
mov byte [edi + 0x3d], al
cmp byte [ebp - 1], al
jne 0x1006e675
xor al, al
jmp 0x1006e67f
push dword [ebp + 0x10]
mov ecx, edi
call fcn.1006e43e
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10072452
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push eax
push ebx
mov edi, ecx
call fcn.10072698
mov esi, eax
test esi, esi
jne 0x10072541
cmp dword [edi + 0x80], eax
je 0x1007252f
cmp dword [ebp + 0x14], 0xffffffff
je 0x100724a4
push dword [ebp + 0x14]
mov ecx, edi
call fcn.10072552
jmp 0x10072529
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x10072521
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or dword [ebp - 0x258], 0xffffffff
push 0
push 0
push eax
lea ecx, [ebp - 0x258]
call fcn.100540c9
cmp dword [ebp - 0x258], 0xffffffff
je 0x10072507
cmp dword [ebp - 0x238], 0
ja 0x10072503
cmp dword [ebp - 0x234], 0x7fffffff
ja 0x10072503
push dword [ebp - 0x234]
mov ecx, edi
call fcn.10072552
mov esi, eax
jmp 0x1007250a
push 8
jmp 0x10072509
push 0x10
pop esi
cmp dword [ebp - 0x258], 0xffffffff
je 0x1007252b
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1007252b
push ebx
mov ecx, edi
call fcn.1007256d
mov esi, eax
test esi, esi
jne 0x1007253f
cmp byte [ebp + 0xc], 0
je 0x1007253f
push ebx
mov ecx, edi
call fcn.10072df8
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret 0x10
Function at 0x10072698
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x220
mov eax, 0x100db566
call fcn.1000240f
mov dword [ebp - 0x220], ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp byte [ebp + 0x10], bl
je 0x1007270d
push ebx
push ebx
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x218]
push eax
push 3
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.MSVCR100.dll__wsplitpath_s]
xor eax, eax
add esp, 0x24
cmp ax, word [ebp - 0x18]
jne 0x100726eb
cmp ax, word [ebp - 0x218]
je 0x1007270d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1007270d
test al, 0x10
je 0x1007270d
mov ecx, dword [ebp - 0x220]
push edi
push esi
call fcn.100728dd
jmp 0x10072816
mov dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x228]
push eax
push 0x5c
push esi
mov dword [ebp - 4], ebx
call fcn.1003fd78
test al, al
jne 0x10072750
lea eax, [ebp - 0x228]
push eax
push 0x2f
push esi
call fcn.1003fd78
test al, al
jne 0x10072750
push esi
lea ecx, [ebp - 0x21c]
call fcn.10006a82
mov esi, dword [ebp - 0x21c]
jmp 0x1007277b
push esi
call fcn.10040105
sub eax, dword [ebp - 0x228]
dec eax
push eax
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.10040035
mov esi, dword [eax]
lea ecx, [ebp - 0x21c]
call fcn.10006af6
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.1004e857
test al, al
jne 0x10072790
push 0x40
jmp 0x10072804
test edi, edi
je 0x10072805
mov ecx, edi
call fcn.1002df15
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.1002deb9
cmp word [eax], bx
je 0x10072805
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x22c]
push eax
mov ecx, edi
call fcn.1002dee7
mov eax, dword [eax]
mov dword [ebp - 0x220], eax
push dword [ebp - 0x21c]
mov ecx, esi
push eax
mov byte [ebp - 4], 1
call fcn.1007281e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x220]
test al, al
jne 0x100727fd
call fcn.10006af6
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.1002deb9
cmp word [eax], bx
je 0x10072805
jmp 0x100727b1
call fcn.10006af6
push 4
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.10006af6
mov eax, ebx
call fcn.10002550
ret 0xc

Function at 0x1007ea2d
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x18], 0x800000
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.10002069
leave
ret
Function at 0x10099f26
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100d28d0
call fcn.1000240f
mov esi, dword [ebp + 8]
push 0x200
lea ecx, [ebp - 0x420]
call fcn.10006ddb
xor eax, eax
mov word [ebp - 0x40c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.1004f339
lea eax, [ebp - 0x420]
push eax
call fcn.100400f6
mov edx, 0x104
cmp eax, edx
jbe 0x10099f98
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov byte [ebp - 0x418], 1
mov word [eax + 0x208], cx
push edx
lea ecx, [ebp - 0x420]
call fcn.10047f6c
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.10008548
mov al, bl
call fcn.10002550
ret 4

Function at 0x1009a218
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4
Function at 0x100aea02
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x100aea0f
lea esi, [ecx - 0x90]
jmp 0x100aea11
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp dword [esi + 0x60], 0
je 0x100aea2e
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x100b4fba
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp ax, word [0x1013e71a]
je 0x100b504c
push edi
mov esi, eax
lea eax, [ebp - 0x20]
push eax
xor edi, edi
push esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
call fcn.10007312
test eax, eax
js 0x100b502d
mov eax, dword [ebp - 0x20]
push edi
push edi
push 0xa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0x85
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call fcn.100b5064
test eax, eax
je 0x100b502d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100c8b31
mov eax, dword [ebp - 0x1c]
test eax, eax
js 0x100b5039
cmp eax, 3
jle 0x100b503b
mov eax, edi
shl esi, 0x10
and eax, 3
or esi, eax
mov dword [0x1013e718], esi
pop edi
jmp 0x100b5052
mov esi, dword [0x1013e718]
mov ecx, dword [ebp - 4]
and esi, 3
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10002069
leave
ret

Function at 0x100b6649
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10106e00], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x100b6672
mov esi, 0x8ff000ff
jmp 0x100b66b7
test ebx, ebx
je 0x100b66b2
call fcn.10007421
mov esi, eax
test esi, esi
js 0x100b66b7
push edi
call fcn.100b7024
mov edi, eax
test edi, edi
je 0x100b66b2
test byte [edi + 0x1f], 4
jne 0x100b66a9
push edi
call fcn.100b84b8
mov esi, eax
test esi, esi
jns 0x100b66a9
cmp esi, 0x8007000e
je 0x100b66b7
xor esi, esi
mov eax, dword [ebp + 0xc]
dec eax
je 0x100b66ca
dec eax
je 0x100b66e2
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret 0xc
mov eax, dword [edi + 0x18]
test eax, eax
je 0x100b66e2
cmp byte [edi + 0x1e], 0
jbe 0x100b66e2
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x100b66b7
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x100b66b2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push ebx
push eax
call fcn.100b6559
mov esi, eax
jmp 0x100b66b7
Function at 0x100b7a19
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
and dword [ebp - 0x220], 0
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x10106de8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [edi + 0x1f]
test byte [ebx], 2
jne 0x100b7c06
cmp dword [edi + 0x14], 0
je 0x100b7a71
push dword [edi + 0x14]
mov ecx, 0x10106e04
call fcn.100078cd
and dword [edi + 0x14], 0
mov byte [edi + 0x1d], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [edi + 4]
call esi
test eax, eax
je 0x100b7b74
lea eax, [ebp - 0x238]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x100b7c40
push 0
call fcn.10007b30
mov dword [ebp - 0x218], eax
test eax, eax
js 0x100b7b74
mov eax, dword [ebp - 0x234]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or ecx, eax
push ecx
mov ecx, 0x10106e04
call fcn.10006213
mov dword [edi + 0x14], eax
test eax, eax
je 0x100b7b87
xor ebx, ebx
cmp dword [ebp - 0x234], ebx
jbe 0x100b7b39
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x238]
push dword [eax + ebx*4]
call fcn.100b50ac
mov dword [ebp - 0x218], eax
test eax, eax
js 0x100b7b29
movzx edx, byte [edi + 0x1d]
mov ecx, dword [edi + 0x14]
mov eax, dword [ebp - 0x21c]
mov dword [ecx + edx*4], eax
inc byte [edi + 0x1d]
jmp 0x100b7b30
cmp eax, 0x8007000e
je 0x100b7b5a
inc ebx
cmp ebx, dword [ebp - 0x234]
jb 0x100b7af5
cmp byte [edi + 0x1d], 0
lea ebx, [edi + 0x1f]
jne 0x100b7bf2
mov eax, dword [ebp - 0x220]
mov byte [edi + 0x1d], al
mov eax, dword [edi + 0x14]
and dword [eax], 0
jmp 0x100b7bf2
push dword [edi + 0x14]
mov ecx, 0x10106e04
call fcn.100078cd
and dword [edi + 0x14], 0
mov byte [edi + 0x1d], 0
jmp 0x100b7c05
push 4
mov ecx, 0x10106e04
call fcn.10006213
mov dword [edi + 0x14], eax
test eax, eax
jne 0x100b7b93
mov dword [ebp - 0x218], 0x8007000e
jmp 0x100b7c05
mov byte [edi + 0x1d], 1
and dword [eax], 0
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [edi + 4]
call esi
test eax, eax
je 0x100b7bf2
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.100b79a9
test eax, eax
je 0x100b7be6
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.100b9f01
mov ecx, dword [edi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x100b7c05
cmp dword [edi + 8], 0xc00
je 0x100b7bfe
or byte [ebx], 2
and dword [ebp - 0x218], 0
pop esi
push 0x10106de8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], 0
pop edi
pop ebx
je 0x100b7c28
lea eax, [ebp - 0x238]
push eax
call fcn.10008479
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.10002069
leave
ret 4
Function at 0x100bc331
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push edi
jne 0x100bc343
mov edi, 0x80004003
jmp 0x100bc38d
push 1
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.100c959c
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x100bc388
push esi
push eax
call fcn.100bc399
pop ecx
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
jne 0x100bc38d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 0x80004005
xor eax, eax
test edi, edi
setns al
pop edi
leave
ret 4

Function at 0x100bc3e1
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push ebx
xor esi, esi
call fcn.100c9737
pop ecx
pop ecx
mov dword [ebp + 8], eax
test eax, eax
je 0x100bc46a
cmp eax, ebx
ja 0x100bc46a
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push edx
push eax
mov eax, dword [ebp + 8]
push 0x100bc474
sub ebx, eax
push 0xffffffffffffffff
lea eax, [edi + eax*2]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll__snwprintf_s]
add esp, 0x18
test eax, eax
jle 0x100bc46a
push esi
call fcn.100bcdb7
pop ecx
test eax, eax
je 0x100bc440
push edi
call fcn.100bc331
mov esi, eax
test esi, esi
jne 0x100bc46a
push 0
call fcn.100bcdb7
pop ecx
test eax, eax
jne 0x100bc46a
cmp word [0x10106ed4], ax
je 0x100bc46a
push 1
push edi
push 0x10106ed4
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100bc46a
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100bd380
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x240], eax
mov esi, 0x104
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.100c07f0
pop ecx
pop ecx
test eax, eax
jne 0x100bd3bd
or eax, 0xffffffff
jmp 0x100bd563
push ebx
xor eax, eax
lea ebx, [ebp - 0x22c]
push edi
mov dword [ebp - 0x234], ebx
cmp word [ebp - 0x22c], ax
je 0x100bd3e4
add ebx, 2
cmp word [ebx], ax
jne 0x100bd3d6
mov dword [ebp - 0x234], ebx
push 1
call fcn.100c0788
pop ecx
push dword [0x1013cbe4]
call fcn.1002bf43
mov edi, eax
mov dword [ebp - 0x230], edi
cmp edi, 0x64
jbe 0x100bd407
xor edi, edi
inc edi
lea eax, [ebp - 0x22c]
sub ebx, eax
sar ebx, 1
push edi
push 0x100bd570
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.100be398
add esp, 0x10
test ebx, ebx
js 0x100bd4b8
cmp ebx, esi
ja 0x100bd4b8
lea ecx, [ebp - 0x23c]
mov eax, esi
sub eax, ebx
push ecx
push eax
call fcn.100bf472
pop ecx
pop ecx
push dword [ebp - 0x23c]
lea eax, [ebp - 0x24]
push dword [ebp - 0x234]
push eax
call fcn.100c890e
push 1
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x22c]
push eax
call fcn.100c959c
mov dword [ebp - 0x238], eax
cmp eax, 0xffffffff
jne 0x100bd51b
cmp edi, 0x64
jb 0x100bd493
xor edi, edi
inc edi
cmp edi, dword [ebp - 0x230]
jne 0x100bd411
push edi
push 0x100bd570
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.100be398
add esp, 0x10
test ebx, ebx
jns 0x100bd4be
call dword [sym.imp.MSVCR100.dll__invalid_parameter_noinfo_noreturn]
cmp ebx, esi
ja 0x100bd4b8
lea eax, [ebp - 0x230]
push eax
sub esi, ebx
push esi
call fcn.100bf472
pop ecx
pop ecx
push dword [ebp - 0x230]
lea eax, [ebp - 0x24]
push dword [ebp - 0x234]
push eax
call fcn.100c890e
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push 0
push ebx
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x22c]
push eax
call fcn.100c959c
mov esi, eax
jmp 0x100bd521
mov esi, dword [ebp - 0x238]
cmp edi, 0x64
jb 0x100bd528
xor edi, edi
cmp byte [ebp + 0x10], 0
je 0x100bd53d
lea eax, [edi + 1]
push eax
push dword [0x1013cbe4]
call fcn.100cb329
call fcn.100bd201
mov eax, dword [ebp - 0x240]
pop edi
pop ebx
test eax, eax
je 0x100bd561
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.100bbefd
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10002069
leave
ret