joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cbc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x41cbe0
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x494e40]
test eax, eax
je 0x41cd50
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41cbcc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41cbcc
test byte [eax + 0x20], 0x30
je 0x41cca0
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41cd40
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41cc50
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41cc42
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x41cda6
mov eax, dword [0x494e40]
test eax, eax
je 0x41cd80
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x41cd00
test eax, eax
je 0x41ccba
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x41cd30
test byte [ebx + 0x24], 4
je 0x41cd17
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41cc49
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x41cc49
test eax, eax
je 0x41cd10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x41cbcc
call sym.__pthread_cleanup_dest.part.3
jmp 0x41ccd2
call sym.__pthread_cleanup_dest.part.3
jmp 0x41cc1e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x494e40], eax
jmp 0x41cbed
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x494e40], eax
jmp 0x41cc7d
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41cc70
Function at 0x41df40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41dfbb
test byte [ebx + 0x20], 0x30
je 0x41dfc2
mov eax, dword [0x494e40]
test eax, eax
je 0x41e04b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41dfb2
cmp dword [eax + 0x14], 0
je 0x41dfd5
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41dfa5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41e01f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x41df5d
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41dfec
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x41e042
mov eax, dword [0x494e40]
test eax, eax
je 0x41e071
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41dfb2
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x41dfff
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41dfff
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x494e40], eax
jmp 0x41df70
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x494e40], eax
jmp 0x41e008
Function at 0x421540
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040f380
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42162f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x4216d3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x421668
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x421660
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x4216d0
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x4216ea
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x4216a2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4216a2
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x4216a2
Function at 0x47f080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
lea eax, [esp + 0x60]
mov dword [esp + 0x34], sym.___gxx_personality_sj0
mov dword [esp + 0x38], 0x48289c
mov dword [esp + 0x40], 0x47f185
mov dword [esp + 0x44], esp
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x18], eax
call dbg._Unwind_SjLj_Register
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x5f]
mov dword [esp + 4], 0
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call sym.std::istream::sentry::sentry_std::istream__bool_
sub esp, 8
cmp byte [esp + 0x5f], 0
jne 0x47f103
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x80]
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x80]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebx + eax + 0x78]
mov edx, dword [ecx + 8]
cmp edx, dword [ecx + 0xc]
jae 0x47f140
movzx eax, byte [edx]
add edx, 1
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x84]
mov byte [edx], al
jmp 0x47f0e8
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x20], 1
call eax
cmp eax, 0xffffffff
jne 0x47f12b
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x80]
mov eax, dword [eax]
add ecx, dword [eax - 0xc]
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x20], 0xffffffff
or eax, 6
mov dword [esp], eax
call method.std::basic_ios_char__std::char_traits_char___.clear_std::_Ios_Iostate_
sub esp, 4
jmp 0x47f0e8
Function at 0x10001025
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x100b7bfc], eax
je 0x10001047
cmp dword [0x100b7bfc], ebx
jne 0x100010db
push edi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edi, dword [ebp - 8]
xor edi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor edi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x100b7bfc
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
test edi, edi
push eax
push dword [ebp - 4]
cmovne ebx, edi
mov edi, 0x100b7bfc
push 4
push edi
mov dword [0x100b7bfc], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push edi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x100b7bfc]
not eax
mov dword [0x101032f0], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002c95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.100029a9
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10002cd2
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
int 0x7f

Function at 0x10002dd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0xa245c62e]
xor eax, 0x24a345c6
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.100029f4
push eax
push esi
push dword [ebp + 8]
call fcn.100029a9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100029f4
call dword [eax + 0x56]
Function at 0x10002f71
Capabilities:
Inspect section memory permissions

Disassembly:
test byte [ebp + 2], bl
add byte [eax], al
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x10002f89
cmp dword [eax + 0xc], ebx
je 0x1000302c
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.100029e4
in eax, dx
or ch, al
xchg edx, eax
cmp dword [ebp + 0xc], ebx
jne 0x10002fb8
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x100031d3
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x10002fcc
mov dword [ebp + 0x10], edi
jmp 0x10002fd1
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.100029e4
pushal
mov ch, 0xaf
std
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x1000301a
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x10002ff5
and eax, 0xffff
push eax
jmp 0x10002ff9
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100029a9
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x100031d3
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x10002fda
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x10002f7b
call fcn.100029e4
and esi, esi
sbb cl, bh
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x10003098
add eax, esi
cmp dword [eax], ebx
je 0x10003098
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10003093
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000307d
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10003085
cmp edx, ebx
jne 0x100031d3
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10003054
add eax, dword [eax + 4]
jmp 0x10003041
mov dword [ebp + 0xc], ebx
jmp 0x100030a3
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100030bb
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100030d9
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
invalid
mov ch, 0x54
invalid

Function at 0x10003251
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
invalid
invalid
invalid
cld

Function at 0x100036c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ss
cmp dword [ebp - 0x398], 0
je 0x100038a2
cmp dword [ebp + 0xc], 1
je 0x100038a2
cmp dword [ebp + 0xc], 8
jne 0x1000386a
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
invalid
inc dword [eax]
call fcn.100029e4
pushal
ljmp 0xfabc
and byte [ebp - 0x230], 0
Function at 0x10003899
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.100029e4
movsb byte es:[edi], byte [esi]
inc ecx
salc
and byte cs:[ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
invalid
invalid
invalid

Function at 0x100038e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100029c2
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
invalid
movsd dword es:[edi], dword [esi]
xchg esp, eax
cld
invalid
invalid

Function at 0x10003e48
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.100029e4
mov edi, 0x8d911485
test esp, edx
clc
invalid

Function at 0x1000438c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test cl, bh
push es
add byte [eax], al
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x1000455f
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
invalid
invalid
xchg al, bh
invalid
Function at 0x1000b5e0
Capabilities:
Compare security identifiers

Disassembly:
cmp dword [0x101056ec], esi
jne 0x1000b610
lea eax, [ebp - 0x50]
mov dword [ebx], esi
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000b61f
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x1000b630
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000b637
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c]
call fcn.1000640a
mov esi, dword [ebp - 0x4c]
test al, al
je 0x1000b63e
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x1000b64f
push 0x44
pop edi
push edi
lea eax, [ebp - 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1000b656
xor ecx, ecx
mov dword [ebp - 0x58], ecx
test esi, esi
jne 0x1000b65d
jmp 0x1000b673
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1000670c
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1000671e
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x58], ecx
add eax, 8
jmp 0x1000b660
mov dword [ebx], edi
mov dword [0x101056ec], edi
mov eax, dword [ebx]
mov dword [0x101034ac], eax
test esi, esi
je 0x10006760
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
jmp 0x10006760
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x1000674b
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 4
xor esi, esi
jmp 0x1000673a
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], esi
push edi
test ebx, ebx
jne 0x10006629
push 0x15b3c8
jmp 0x1000b624
mov eax, dword [0x101034ac]
xor edi, edi
mov dword [ebx], eax
inc edi
jmp 0x1000673a
push 0x15b3c9
call fcn.1008ee44
mov edi, esi
jmp 0x1000673a
push 0x15b3ca
jmp 0x1000b624
push 0x15b3cb
jmp 0x1000b624
push 0x15b3cc
call fcn.1008ee44
xor edi, edi
jmp 0x1000672d
push 0x15b3cd
jmp 0x1000b643
push 0x15b3ce
jmp 0x1000b643
lea eax, [esi + 4]
xor edi, edi
mov dword [ebp - 0x4c], eax
inc edi
cmp ecx, dword [esi]
jb 0x100066ed
jmp 0x10006720
xor ecx, ecx
mov dword [0], 1
int 0x29

Function at 0x1001ebaa
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
Function at 0x1002ffd5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x1003014d
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1003000b
mov eax, dword [ebp + 0xc]
jmp 0x10030033
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x10030028
call edi
push eax
push 0x2e6e776a
call fcn.1003cf9b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x10030053
call edi
push eax
push 0x2e6e776b
call fcn.1003cf9b
movzx eax, word [ebp - 0x18]
push 0x30
pop ecx
sub eax, ecx
push 0xa
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
push dword [esi]
call ebx
mov dword [ebp - 0x1c], eax
test eax, eax
jg 0x10030082
call edi
push eax
push 0x2e6e776c
call fcn.1003cf9b
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [esi + 0x18], edx
cmp eax, 2
jl 0x100300d3
add eax, 0xfffffffe
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x100300b7
cmp word [ebp + edx*2 - 0x18], 0x3b
je 0x100300b2
imul ecx, dword [esi + 0x18], 0xa
movzx eax, word [ebp + edx*2 - 0x18]
add ecx, 0xffffffd0
add eax, ecx
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x1c]
inc edx
cmp edx, eax
jl 0x10030096
movzx eax, word [ebp + eax*2 - 0x18]
push 0x30
pop ecx
cmp ax, cx
je 0x100300d3
imul ecx, dword [esi + 0x18], 0xa
add ecx, 0xffffffd0
add eax, ecx
imul eax, eax, 0xa
mov dword [esi + 0x18], eax
push 5
lea eax, [esi + 0x48]
push eax
push 0xe
push dword [esi]
call ebx
test eax, eax
jne 0x100300f0
call edi
push eax
push 0x2e6e776d
call fcn.1003cf9b
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x52]
push eax
push 0xf
push dword [esi]
call ebx
test eax, eax
jne 0x10030113
call edi
push eax
push 0x2e6e776e
call fcn.1003cf9b
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x18]
push eax
push 0x1010
push dword [esi]
call ebx
test eax, eax
jne 0x10030139
call edi
push eax
push 0x2e6e776f
call fcn.1003cf9b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
pop edi
mov dword [esi + 0x24], eax
mov byte [esi + 0xa], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001550
mov esp, ebp
pop ebp
ret 8

Function at 0x100319df
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 8]
push eax
push 0x20001009
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [ebp - 8]
cmp eax, 8
ja 0x10031a23
je 0x10031a28
test eax, eax
je 0x10031a28
cmp eax, 5
jbe 0x10031a2b
cmp eax, 6
je 0x10031a28
cmp eax, 7
jne 0x10031a28
jmp 0x10031a2b
cmp eax, 0xc
jbe 0x10031a2b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret