joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10090ccf
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100da0ec
call fcn.100b286c
sub esp, 0x30
push ebx
mov ebx, ecx
cmp dword [ebx + 0x80], 0
push esi
push edi
je 0x10090e76
cmp dword [ebx + 0xac], 0
je 0x10090e76
mov eax, dword [ebx + 0x14]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [ebx + 0x44]
mov edi, eax
call fcn.10082428
mov ecx, dword [ebx + 0x14]
push eax
call fcn.100800ce
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebx + 0x14]
push eax
call fcn.1008007a
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_GetLayout]
push esi
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
test byte [ebp - 0x10], 1
je 0x10090d50
mov eax, dword [ebp - 0x3c]
add eax, 0x14
jmp 0x10090d60
mov ecx, dword [ebx + 0x44]
push 0x9f
call fcn.1006b929
add eax, dword [ebp - 0x3c]
mov esi, dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push edi
call esi
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push edi
call esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
xor esi, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0xbc]
cmp eax, 0xc8
jbe 0x10090e01
mov ecx, dword [ebx + 0x44]
xor eax, eax
inc eax
mov dword [ebx + 0x88], eax
mov dword [ebp - 0x10], eax
call fcn.1006bf27
cmp eax, esi
je 0x10090ddd
mov ecx, dword [ebx + 0xac]
push eax
call fcn.100652b1
mov ecx, dword [ebx + 0xac]
mov eax, dword [ecx]
push edi
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, dword [ebx + 0x44]
call fcn.1006b792
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x10], esi
mov dword [ebx + 0xbc], eax
mov dword [ebx + 0x88], esi
je 0x10090e76
push esi
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x100df794
call fcn.1007e254
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.OPEN_MENU
mov dword [ebp - 4], esi
call fcn.1007e254
sub esp, 0xc
lea eax, [ebx + 0x1c]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 1
call fcn.1007ed4f
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.RADIO
mov byte [ebp - 4], 2
call fcn.1007e254
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.10083559
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10092779
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x100da4da
call fcn.100b286c
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [esi], 0x100f0f04
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.1007ed4f
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.1007ed4f
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.1007ed4f
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.1007ed4f
lea eax, [edi + 0x3c]
push eax
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.1007ed4f
lea eax, [edi + 0x48]
push eax
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.1007ed4f
mov eax, dword [edi + 0x54]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1009c421
Capabilities:
Parse url

Disassembly:
mov eax, 0x100db81c
call fcn.100b286c
mov eax, 0x20dc
call fcn.100b50b0
mov eax, dword [0x10120240]
push ebx
mov dword [ebp - 0x10], eax
push esi
mov esi, 0x1048
xor ebx, ebx
push esi
lea eax, [ebp - 0x20a0]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.100b2930
push esi
lea eax, [ebp - 0x1058]
push ebx
push eax
call fcn.100b2930
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x20e8]
push ebx
push eax
call fcn.100b2930
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x20d8], eax
mov eax, 0x823
add esp, 0x24
mov dword [ebp - 0x20d4], eax
mov dword [ebp - 0x20b8], eax
lea eax, [ebp - 0x20e8]
push eax
lea ecx, [ebp - 0x20a0]
push 0x10000000
mov dword [ebp - 0x20bc], ecx
push ebx
lea ecx, [ebp + 8]
mov dword [ebp - 0x20e8], esi
call fcn.1007e49f
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov esi, eax
cmp esi, ebx
je 0x1009c530
lea eax, [ebp - 0x1058]
push eax
lea ecx, [ebp - 0x20ac]
call fcn.1007e254
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0x20ac]
push eax
mov byte [ebp - 4], 1
call fcn.1007e46a
lea ecx, [ebp - 0x20ac]
mov byte [ebp - 4], bl
call fcn.1007e410
lea eax, [ebp - 0x20a0]
push eax
lea ecx, [ebp - 0x20ac]
call fcn.1007e254
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x20ac]
push eax
mov byte [ebp - 4], 2
call fcn.1007e46a
lea ecx, [ebp - 0x20ac]
mov byte [ebp - 4], bl
call fcn.1007e410
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.100b29c1
leave
ret 0x14
Function at 0x1009cf90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebx + 0x60]
push edi
call fcn.10064d76
test eax, eax
jle 0x1009d008
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0xc0]
cmp eax, 0xc8
jbe 0x1009cffc
mov ecx, dword [ebx + 0xc4]
lea eax, [ebp - 0x10]
push eax
call fcn.1009a763
test eax, eax
je 0x1009cffc
mov eax, dword [ebx + 0x14]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [ebx + 0x60]
mov esi, eax
mov eax, dword [ecx]
push 0
call dword [eax + 0x38]
mov ecx, dword [ebx + 0x60]
mov eax, dword [ecx]
push esi
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x40
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xc0], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1009ecba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x100dbdc7
call fcn.100b286c
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.1008ebb6
xor ebx, ebx
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], ebx
mov dword [esi], 0x100f4268
call fcn.1007ed28
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 1
call fcn.100a8780
lea ecx, [esi + 0xbc]
mov byte [ebp - 4], 2
call fcn.1007e247
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 3
call fcn.1007e247
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 4
call fcn.1007e247
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 5
call fcn.1007e247
lea ecx, [esi + 0xec]
mov byte [ebp - 4], 6
call fcn.1007e247
lea ecx, [esi + 0xf8]
mov byte [ebp - 4], 7
call fcn.1007e247
lea ecx, [esi + 0x104]
mov byte [ebp - 4], 8
call fcn.1007e247
lea ecx, [esi + 0x110]
mov byte [ebp - 4], 9
call fcn.1007e247
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 0xa
call fcn.1007e247
mov edi, 0x100df794
push edi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0x94], ebx
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x104]
mov byte [ebp - 4], 0xc
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.1007e410
push edi
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x110]
mov byte [ebp - 4], 0xd
call fcn.1007e46a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1c]
call fcn.1007e410
push edi
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 0xe
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.1007e410
push edi
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 0xf
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.1007e410
push edi
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xbc]
mov byte [ebp - 4], 0x10
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.1007e410
push edi
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 0x11
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.1007e410
push edi
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xec]
mov byte [ebp - 4], 0x12
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.1007e410
push edi
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xf8]
mov byte [ebp - 4], 0x13
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100a3cad
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0x46a
push dword [esi + 4]
call edi
cmp dword [esp + 0x14], 0
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
je 0x100a3d28
push 5
push eax
call ebx
push 0x46c
push dword [esi + 4]
call edi
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push eax
mov dword [esp + 0x18], eax
call ebp
test eax, eax
je 0x100a3cf8
push 5
push dword [esp + 0x18]
call ebx
push 0x453
push dword [esi + 4]
call edi
push eax
mov dword [esp + 0x18], eax
call ebp
test eax, eax
je 0x100a3d15
push 5
push dword [esp + 0x18]
call ebx
push 0x49c
push dword [esi + 4]
call edi
push 5
push eax
call ebx
push 1
jmp 0x100a3d7e
push 0
push eax
call ebx
push 0x46c
push dword [esi + 4]
call edi
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push eax
mov dword [esp + 0x18], eax
call ebp
test eax, eax
je 0x100a3d50
push 0
push dword [esp + 0x18]
call ebx
push 0x453
push dword [esi + 4]
call edi
push eax
mov dword [esp + 0x18], eax
call ebp
test eax, eax
je 0x100a3d6d
push 0
push dword [esp + 0x18]
call ebx
push 0x49c
push dword [esi + 4]
call edi
push 0
push eax
call ebx
push 0
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x100a5304
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push 0x100e37e4
mov edi, 0x44b
mov esi, ecx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push edi
mov ecx, esi
call fcn.100a3456
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x485
push dword [esi + 4]
call ebx
cmp dword [esp + 0x10], 0
je 0x100a5390
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
push 5
push eax
call edi
push 0x49c
push dword [esi + 4]
call ebx
mov ebp, eax
push 5
push ebp
call edi
lea eax, [esi + 0x130]
xor ecx, ecx
cmp dword [eax], ecx
je 0x100a536a
mov dword [eax], ecx
push ecx
jmp 0x100a536c
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x453
push dword [esi + 4]
call ebx
mov esi, eax
push 5
push esi
call edi
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
pop ebp
jmp 0x100a5399
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
ret 4
Function at 0x100a55c1
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x100dc6d9
call fcn.100b286c
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x58]
mov ecx, ebx
call fcn.10002e30
mov esi, eax
jmp 0x100a3094
push esi
mov ecx, ebx
call fcn.10002e85
test eax, eax
je 0x100a3094
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
dec esi
jns 0x100a3080
mov ecx, dword [edi + 0x94]
lea esi, [edi + 0x58]
push esi
xor ebx, ebx
call fcn.100a823b
test eax, eax
je 0x100a311f
mov ecx, esi
call fcn.10002e30
and dword [ebp - 0x10], 0
mov ebx, eax
test ebx, ebx
jle 0x100a311f
push dword [ebp - 0x10]
lea ecx, [edi + 0x58]
call fcn.10002e3e
mov esi, eax
test esi, esi
je 0x100a3117
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ed4f
and dword [ebp - 4], 0
push 0x100f472c
lea ecx, [ebp - 0x1c]
call fcn.1007ee1f
lea ecx, [esi + 0x10]
call fcn.1007e558
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ee1f
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.100a2fd4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1007e410
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100a30bd
and dword [ebp - 0x10], 0
push 4
pop esi
cmp ebx, esi
jge 0x100a3183
sub esi, ebx
xor ebx, ebx
inc ebx
cmp esi, ebx
jl 0x100a3183
cmp ebx, 1
jne 0x100a3141
mov dword [ebp - 0x10], 0x47d
jmp 0x100a3169
cmp ebx, 2
jne 0x100a314f
mov dword [ebp - 0x10], 0x47c
jmp 0x100a3169
cmp ebx, 3
jne 0x100a315d
mov dword [ebp - 0x10], 0x47b
jmp 0x100a3169
cmp ebx, 4
jne 0x100a3169
mov dword [ebp - 0x10], 0x47a
push dword [ebp - 0x10]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc ebx
cmp ebx, esi
jle 0x100a3133
lea ecx, [edi + 0x58]
call fcn.10002e30
test eax, eax
je 0x100a3196
push 0x100f48dc
jmp 0x100a319b
push 0x100e3b38
push 0x452
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
mov dword [esi + 0x13c], edi
call fcn.100a5304
push edi
mov ecx, esi
call fcn.100a383e
push edi
mov ecx, esi
call fcn.100a2bc0
push edi
mov ecx, esi
call fcn.100a3cad
push 1
mov ecx, esi
call fcn.100a4cfa
pop edi
mov ecx, esi
pop esi
jmp 0x100a3060
Function at 0x100a68c7
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x100dcb74
call fcn.100b286c
sub esp, 0x38
and dword [ebp - 0x10], 0
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
inc ebx
test esi, esi
push edi
mov edi, ecx
je 0x100a6926
push str.SUGGESTION
lea ecx, [ebp - 0x2c]
call fcn.1007e254
and dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.100ad8ff
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 3
call fcn.1007f09b
test eax, eax
mov byte [ebp + 0xb], bl
jne 0x100a692a
mov byte [ebp + 0xb], 0
and dword [ebp - 4], 0
test byte [ebp - 0x10], 2
je 0x100a6940
and dword [ebp - 0x10], 0xfffffffd
lea ecx, [ebp - 0x38]
call fcn.1007e410
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x10], bl
je 0x100a6951
lea ecx, [ebp - 0x2c]
call fcn.1007e410
cmp byte [ebp + 0xb], 0
je 0x100a6aa8
lea ecx, [ebp - 0x20]
call fcn.1007e247
sub esp, 0xc
mov ecx, esp
mov dword [ebp + 8], esp
push str.CITY
mov dword [ebp - 4], 2
call fcn.1007e254
mov ecx, esi
call fcn.100ae0f8
test eax, eax
je 0x100a69c3
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.100adc48
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.1007e46a
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.1007e410
lea ecx, [ebp - 0x20]
call fcn.1007e67a
test eax, eax
jne 0x100a69c3
lea eax, [ebp - 0x20]
push eax
lea ecx, [edi + 4]
call fcn.1007e46a
sub esp, 0xc
mov ecx, esp
mov dword [ebp + 8], esp
push str.COUNTRY
call fcn.1007e254
mov ecx, esi
call fcn.100ae0f8
test eax, eax
je 0x100a6a1c
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.100adc48
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.1007e46a
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.1007e410
lea ecx, [ebp - 0x20]
call fcn.1007e67a
test eax, eax
jne 0x100a6a1c
lea eax, [ebp - 0x20]
push eax
lea ecx, [edi + 0x10]
call fcn.1007e46a
sub esp, 0xc
mov ecx, esp
mov dword [ebp + 8], esp
push str.LOCATION_ID
call fcn.1007e254
mov ecx, esi
call fcn.100ae0f8
test eax, eax
je 0x100a6a75
lea ecx, [ebp - 0x44]
push ecx
mov ecx, eax
call fcn.100adc48
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.1007e46a
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.1007e410
lea ecx, [ebp - 0x20]
call fcn.1007e67a
test eax, eax
jne 0x100a6a75
lea eax, [ebp - 0x20]
push eax
lea ecx, [edi + 0x1c]
call fcn.1007e46a
lea ecx, [edi + 4]
call fcn.1007e67a
test eax, eax
jne 0x100a6a9c
lea ecx, [edi + 0x10]
call fcn.1007e67a
test eax, eax
jne 0x100a6a9c
lea ecx, [edi + 0x1c]
call fcn.1007e67a
test eax, eax
jne 0x100a6a9c
mov dword [ebp - 0x14], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x100a6abc
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x100dcbbf
call fcn.100b286c
sub esp, 0x50
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov esi, ecx
push str._SUGGESTION___SUGGESTION_
lea ecx, [ebp - 0x24]
call fcn.1007e254
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], ebx
call fcn.100ad011
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.100ad240
test eax, eax
je 0x100a6bbc
lea ecx, [ebp - 0x5c]
call fcn.100accda
mov edi, eax
test edi, edi
je 0x100a6bbc
push ebx
sub esp, 0xc
lea eax, [esi + 4]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.1007ed4f
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.CITY
mov byte [ebp - 4], 3
call fcn.1007e254
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100ae6ce
push ebx
sub esp, 0xc
lea eax, [esi + 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.1007ed4f
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.COUNTRY
mov byte [ebp - 4], 4
call fcn.1007e254
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100ae6ce
push ebx
sub esp, 0xc
add esi, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.1007ed4f
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.LOCATION_ID
mov byte [ebp - 4], 5
call fcn.1007e254
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100ae6ce
push dword [ebp + 8]
mov ecx, edi
call fcn.100ada11
jmp 0x100a6bc9
mov ecx, dword [ebp + 8]
push 0x100df794
call fcn.1007e254
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], bl
call fcn.100acecc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x100a824b
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x100dd130
call fcn.100b286c
sub esp, 0x3c
mov eax, dword [0x10120240]
mov ecx, dword [ecx + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 0x10], eax
call fcn.100232aa
xor ebx, ebx
cmp eax, ebx
jne 0x100a83c2
lea ecx, [ebp - 0x3c]
call fcn.1007e247
push 0x14
lea eax, [ebp - 0x24]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.100b2930
add esp, 0xc
push 0xa
lea eax, [ebp - 0x24]
push eax
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
lea ecx, [ebp - 0x30]
jne 0x100a82e1
push 0x100f46fc
call fcn.1007e254
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1007e46a
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1007e410
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.1007e410
jmp 0x100a83c2
push edi
lea eax, [ebp - 0x24]
push eax
call fcn.1007e254
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.1007e46a
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1007e410
push 0x100e398c
lea ecx, [ebp - 0x30]
call fcn.1007e254
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.1007f09b
lea ecx, [ebp - 0x30]
mov edi, eax
mov byte [ebp - 4], bl
call fcn.1007e410
cmp edi, ebx
lea ecx, [ebp - 0x30]
je 0x100a8347
push 0x100f4700
call fcn.1007e254
mov byte [ebp - 4], 4
jmp 0x100a8383
push 0x100e405c
call fcn.1007e254
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.1007f09b
lea ecx, [ebp - 0x30]
mov edi, eax
mov byte [ebp - 4], bl
call fcn.1007e410
cmp edi, ebx
push 0x100f46fc
je 0x100a8393
lea ecx, [ebp - 0x30]
call fcn.1007e254
mov byte [ebp - 4], 6
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.1007e46a
lea ecx, [ebp - 0x30]
jmp 0x100a83ad
lea ecx, [ebp - 0x48]
call fcn.1007e254
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.1007e46a
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.1007e410
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.1007e410
pop edi
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
inc eax
pop ebx
call fcn.100b29c1
leave
ret 4
Function at 0x100b2de1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x100b2dfd
call fcn.100b9c58
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x100b2e6f
push esi
push 0x8c
push 1
call fcn.100b5329
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x100b2e55
push esi
call fcn.100b69c9
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x100b2d4f
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x100b2e4d
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x100b2e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.100b29e2
test ebx, ebx
pop ecx
je 0x100b2e67
push ebx
call fcn.100b9c6a
pop ecx
or eax, 0xffffffff
jmp 0x100b2e6e
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x100b5176
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.100b50b0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100b5211
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x10121860]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x100b5211
cmp eax, 1
je 0x100b5232
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100b5211
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x100b51de
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x100b520d
xor eax, eax
inc eax
jmp 0x100b5251
cmp edi, eax
jae 0x100b5215
xor eax, eax
jmp 0x100b5251
cmp eax, esi
jae 0x100b521c
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10121860]
jmp 0x100b5235
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret