joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102ae14
Capabilities:
Get geographical location

Disassembly:
push 0x168
mov eax, 0x106a91b
call fcn.0101da7e
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x174], esi
mov eax, dword [0x1077004]
mov ebx, 0x1077004
cmp eax, ebx
je 0x102ae5b
test dword [eax + 0x1c], 0x100
je 0x102ae5b
cmp byte [eax + 0x19], 4
jb 0x102ae5b
push 0x1007300
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add edx, 0xffffffff
mov eax, ecx
adc eax, 0xffffffff
xor edi, edi
cmp eax, edi
ja 0x102ae80
jb 0x102ae79
cmp edx, 0x3fe
ja 0x102ae80
xor eax, eax
inc eax
xor ecx, ecx
jmp 0x102ae8a
mov eax, dword [ebp + 8]
shrd eax, ecx, 0xa
shr ecx, 0xa
push ecx
push eax
push 0x1007594
push esi
mov dword [ebp - 4], edi
call sub.MFC42u.dll_CString::Format
mov eax, dword [esi]
or dword [ebp - 4], 0xffffffff
add esp, 0x10
push 0x64
lea ecx, [ebp - 0x170]
push ecx
push edi
push eax
push edi
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
jne 0x102aefe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x102aef7
test dword [eax + 0x1c], 0x100
je 0x102aef7
cmp byte [eax + 0x19], 2
jb 0x102aef7
push esi
push 0x1007574
push 0x1007300
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
mov eax, esi
jmp 0x102b08b
push 0xa
lea eax, [ebp - 0x28]
push eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, edi
jne 0x102af40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x102aef7
test dword [eax + 0x1c], 0x100
je 0x102aef7
cmp byte [eax + 0x19], 2
jb 0x102aef7
push esi
push 0x1007558
push 0x1007300
push 0x30
jmp 0x102aeec
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
cmp eax, edi
je 0x102af5c
xor ecx, ecx
mov word [eax], cx
xor eax, eax
push 0x7e
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xa6]
push edi
push eax
mov dword [ebp - 4], 2
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x1078984], edi
je 0x102af92
mov eax, 0x202d
mov word [ebp - 0xa8], ax
push 0x100754c
push 0x40
lea eax, [ebp - 0xa8]
push eax
call fcn.0101e5fc
cmp eax, edi
jge 0x102aff4
mov ecx, eax
and ecx, 0x1fff0000
movzx esi, ax
cmp ecx, 0x70000
je 0x102afbe
mov esi, eax
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x102aef7
test dword [eax + 0x1c], 0x100
je 0x102aef7
cmp byte [eax + 0x19], 2
jb 0x102aef7
push esi
push 0x1007530
push 0x1007300
push 0x31
jmp 0x102aeec
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0x174]
call sub.MFC42u.dll_CString::Format
add esp, 0xc
xor eax, eax
jmp 0x102b08b
call fcn.0101dae9
ret 0xc
Function at 0x102b5b1
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov eax, dword [0x1077004]
mov edi, 0x1077004
cmp eax, edi
je 0x102b5e9
test dword [eax + 0x1c], 0x100
je 0x102b5e9
cmp byte [eax + 0x19], 4
jb 0x102b5e9
push 0x10075a0
push 0x3b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x10108a4
push 1
push 0
push 0x10108c4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x102b6cd
mov eax, dword [ebp - 4]
push dword [ebp + 8]
and dword [ebp - 8], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov esi, eax
test esi, esi
jl 0x102b692
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jl 0x102b692
push dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov esi, eax
test esi, esi
jl 0x102b692
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
jl 0x102b692
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x10108b4
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x102b692
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jge 0x102b6c2
mov eax, dword [0x1077004]
cmp eax, edi
je 0x102b6c2
test dword [eax + 0x1c], 0x100
je 0x102b6c2
cmp byte [eax + 0x19], 2
jb 0x102b6c2
push esi
push 0x10077bc
push 0x10075a0
push 0x3c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x102b6fd
mov eax, dword [0x1077004]
cmp eax, edi
je 0x102b6fd
test dword [eax + 0x1c], 0x100
je 0x102b6fd
cmp byte [eax + 0x19], 2
jb 0x102b6fd
push esi
push 0x1007778
push 0x10075a0
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
pop edi
mov eax, esi
pop esi
leave
ret 0x18
Function at 0x102e9bb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [ebp + 8]
push eax
push 0x10089a0
push 0x10062e0
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jle 0x102e9fc
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 8

Function at 0x103573e
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3d8
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3d4], eax
lea eax, [ebp - 0x3c8]
push eax
push 0x202
mov dword [ebp - 0x3d0], 0x1c
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x3d8], eax
test eax, eax
je 0x103579c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3cc], eax
jmp 0x1035866
mov esi, dword [sym.imp.WS2_32.dll_WSAStringToAddressW]
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0x238]
push eax
push 0
push 0x17
push edi
call esi
mov dword [ebp - 0x3cc], eax
test eax, eax
je 0x10357f6
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 2
push edi
mov dword [ebp - 0x3d0], 0x10
call esi
mov dword [ebp - 0x3cc], eax
test eax, eax
jne 0x103586f
lea ecx, [ebp - 0x21c]
jmp 0x10357fc
lea ecx, [ebp - 0x238]
push 8
mov eax, 0x104
push eax
lea edx, [ebp - 0x20c]
push edx
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x3d0]
push ecx
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x1035832
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3cc], eax
jmp 0x103586f
lea eax, [ebp - 0x108]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x103584a
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
call fcn.01020f81
push eax
mov dword [ebx], eax
call fcn.01021142
mov ecx, dword [ebp - 0x3d4]
mov dword [ecx], eax
cmp dword [ebp - 0x3d8], 0
jne 0x1035875
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret 0xc
Function at 0x10383c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [0x1077004]
mov ebx, 0x1077004
cmp eax, ebx
je 0x10383ff
test dword [eax + 0x1c], 0x100
je 0x10383ff
cmp byte [eax + 0x19], 4
jb 0x10383ff
push dword [esi + 4]
push 0x100a12c
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
and dword [esi + 0x44], 0
xor edi, edi
inc edi
push edi
mov ecx, esi
mov dword [esi + 0x48], edi
call fcn.01037f04
mov dword [ebp - 4], eax
lea eax, [esi + 0x2c]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 4], 0
je 0x1038462
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x1038459
test dword [eax + 0x1c], 0x100
je 0x1038459
cmp byte [eax + 0x19], 2
jb 0x1038459
push dword [ebp - 4]
push 0x100a208
push 0x100a12c
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
and dword [esi + 0x48], 0
jmp 0x1038534
push 0
mov ecx, esi
mov dword [esi + 0x4c], edi
call fcn.0103830d
xor edi, edi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x10384b7
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x103852e
test dword [eax + 0x1c], 0x100
je 0x103852e
cmp byte [eax + 0x19], 2
jb 0x103852e
push dword [ebp - 4]
push 0x100a1d0
push 0x100a12c
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
jmp 0x103852e
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 0x10380ad
push edi
push edi
mov dword [esi + 0x20], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
cmp eax, edi
jne 0x1038534
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x103850f
test dword [eax + 0x1c], 0x100
je 0x103850f
cmp byte [eax + 0x19], 2
jb 0x103850f
push dword [ebp - 4]
push 0x100a1b4
push 0x100a12c
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
call fcn.01015eea
cmp eax, edi
je 0x103852e
push 0x15019a
push dword [ebp - 4]
push 0x8003
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x103be29
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
mov eax, dword [0x1077004]
mov edi, 0x1077004
cmp eax, edi
je 0x103be66
test dword [eax + 0x1c], 0x100
je 0x103be66
cmp byte [eax + 0x19], 4
jb 0x103be66
push dword [esi + 0x18]
push 0x100a2b8
push 0x50
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e103
push 1
mov ecx, esi
call fcn.01038e27
mov dword [ebp - 4], eax
lea eax, [esi + 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
cmp dword [ebp - 4], eax
je 0x103beb3
mov eax, dword [0x1077004]
cmp eax, edi
je 0x103bf1b
test dword [eax + 0x1c], 0x100
je 0x103bf1b
cmp byte [eax + 0x19], 2
jb 0x103bf1b
push dword [ebp - 4]
push 0x100a904
push 0x100a2b8
push 0x51
jmp 0x103bf10
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push 0x103bda4
push eax
push eax
mov dword [esi + 0x1f0], 1
mov dword [esi + 0x1ec], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1e8], eax
test eax, eax
jne 0x103bf1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [0x1077004]
cmp eax, edi
je 0x103bf1b
test dword [eax + 0x1c], 0x100
je 0x103bf1b
cmp byte [eax + 0x19], 2
jb 0x103bf1b
push dword [ebp - 4]
push 0x100a1b4
push 0x100a2b8
push 0x52
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
lea eax, [esi + 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
test eax, eax
je 0x103bf36
and dword [esi + 0x1f0], 0
pop edi
pop esi
leave
ret
Function at 0x103dbef
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0x38
lea eax, [ebp - 0x450]
push esi
push eax
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x454], esi
call sub.msvcrt.dll_memset
push edi
push 0x100b2e8
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.010166de
mov edi, eax
xor eax, eax
add esp, 0x1c
cmp edi, eax
jge 0x103dc97
mov eax, dword [0x1077004]
cmp eax, 0x1077004
je 0x103dc7a
test dword [eax + 0x1c], 0x100
je 0x103dc7a
cmp byte [eax + 0x19], 2
jb 0x103dc7a
push edi
push 0x100ad2c
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
mov eax, edi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x103dc90
movzx esi, di
jmp 0x103ddaf
mov esi, edi
jmp 0x103ddaf
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x454]
lea ecx, [ebp - 0x414]
push eax
mov dword [ebp - 0x454], 0x3c
mov dword [ebp - 0x450], 0x500
mov dword [ebp - 0x448], 0x100b2d8
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ecx
mov dword [ebp - 0x438], 7
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x103ddaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1077004]
mov edi, 0x1077004
cmp eax, edi
je 0x103dd59
test dword [eax + 0x1c], 0x100
je 0x103dd59
cmp byte [eax + 0x19], 2
jb 0x103dd59
push esi
push 0x100ad2c
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
mov eax, dword [0x1077004]
cmp esi, 0x483
jne 0x103dd7e
push ebx
call fcn.01067d92
test eax, eax
je 0x103dd84
push ebx
push dword [ebp - 0x418]
call fcn.0103d5c5
mov esi, eax
mov eax, dword [0x1077004]
test esi, esi
je 0x103ddaf
jmp 0x103dd89
mov eax, dword [0x1077004]
cmp eax, edi
je 0x103ddaf
test dword [eax + 0x1c], 0x100
je 0x103ddaf
cmp byte [eax + 0x19], 2
jb 0x103ddaf
push esi
push 0x100ad2c
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret 8
Function at 0x103fe8b
Capabilities:
Copy file

Disassembly:
push 0x23c
mov eax, 0x106b743
call fcn.0101da7e
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x230], eax
mov eax, dword [0x1077004]
mov ebx, 0x1077004
cmp eax, ebx
je 0x103fedb
test dword [eax + 0x1c], 0x100
je 0x103fedb
cmp byte [eax + 0x19], 4
jb 0x103fedb
push 0x100b708
push 0x3b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
xor eax, eax
lea edi, [ebp - 0x244]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi]
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x248], 2
mov dword [ebp - 0x244], eax
call sub.MFC42u.dll_CString::CString_3
mov edi, dword [ebp - 0x22c]
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x248]
push eax
lea ecx, [edi + 0x124]
call fcn.0102eba1
test eax, eax
jl 0x103ffb1
push dword [esi]
lea eax, [ebp - 0x228]
push 0xef32
push eax
mov byte [ebp - 4], 1
call sub.MFC42u.dll_AfxFormatString1
and dword [ebp - 4], 0
push 0
push 0x34
push dword [ebp - 0x228]
call fcn.0102a3ed
cmp eax, 6
je 0x103ffb1
xor esi, esi
jmp 0x103ff9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call sub.MFC42u.dll_CString::CString
mov eax, esi
jmp 0x1040130
push 0x105
lea eax, [ebp - 0x220]
push eax
call fcn.01022195
test eax, eax
jne 0x1040000
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x103ff9b
test dword [eax + 0x1c], 0x100
je 0x103ff9b
cmp byte [eax + 0x19], 2
jb 0x103ff9b
push esi
push 0x100ba44
push 0x100b708
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
jmp 0x103ff9b
lea ecx, [ebp - 0x224]
call sub.MFC42u.dll_CString::CString_3
push dword [esi]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push 0x10055e8
push eax
mov byte [ebp - 4], 4
call sub.MFC42u.dll_CString::Format
mov eax, dword [ebp - 0x230]
mov eax, dword [eax]
add esp, 0x10
push 0
push dword [ebp - 0x224]
mov dword [ebp - 4], 3
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x104009a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x1040086
test dword [eax + 0x1c], 0x100
je 0x1040086
cmp byte [eax + 0x19], 2
jb 0x1040086
push esi
push 0x100bcd8
push 0x100b708
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0
call sub.MFC42u.dll_CString::CString
jmp 0x103ff9b
mov ecx, edi
call fcn.0103f891
mov esi, eax
test esi, esi
je 0x1040086
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x1040086
test dword [eax + 0x1c], 0x100
je 0x1040086
cmp byte [eax + 0x19], 2
jb 0x1040086
push esi
push 0x100bcbc
push 0x100b708
push 0x40
jmp 0x104007b
call fcn.0101dae9
ret 8
Function at 0x104013d
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [0x1077004]
mov esi, 0x1077004
mov edi, 0x100b708
cmp eax, esi
je 0x104017a
test dword [eax + 0x1c], 0x100
je 0x104017a
cmp byte [eax + 0x19], 4
jb 0x104017a
push edi
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x10401c1
push dword [ebp + 8]
call fcn.0102139e
mov ebx, eax
test ebx, ebx
jne 0x10401c1
mov eax, dword [0x1077004]
cmp eax, esi
je 0x10401bc
test dword [eax + 0x1c], 0x100
je 0x10401bc
cmp byte [eax + 0x19], 2
jb 0x10401bc
push 8
push 0x100bcec
push edi
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
push 8
pop eax
jmp 0x104022f
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push ebx
push 0x103f482
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1079df8], eax
test eax, eax
jne 0x1040225
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1040216
test dword [eax + 0x1c], 0x100
je 0x1040216
cmp byte [eax + 0x19], 2
jb 0x1040216
push dword [ebp + 8]
push 0x100a1b4
push edi
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
test ebx, ebx
je 0x1040220
push ebx
call fcn.0101e9ef
mov eax, dword [ebp + 8]
jmp 0x104022f
mov ecx, dword [ebp - 4]
call fcn.0103f2d3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10414eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x830
mov eax, 0x106b899
call fcn.0101da7e
mov esi, ecx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x818], edx
mov eax, dword [0x1077004]
mov ebx, 0x1077004
cmp eax, ebx
je 0x1041538
test dword [eax + 0x1c], 0x100
je 0x1041538
cmp byte [eax + 0x19], 4
jb 0x1041538
push 0x100bf60
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
xor edx, edx
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x838], edx
lea edi, [ebp - 0x834]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push edx
mov dword [esi + 4], eax
mov dword [esi + 8], edx
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jl 0x10415b3
lea eax, [ebp - 0x838]
push eax
push dword [ebp + 8]
call sub.FxsCompose.dll_HrGetDraftsListViewInfo
test eax, eax
jge 0x10415ab
movzx ecx, ax
mov dword [ebp - 0x818], ecx
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x10415ab
test dword [eax + 0x1c], 0x100
je 0x10415ab
cmp byte [eax + 0x19], 2
jb 0x10415ab
push ecx
push 0x100c070
push 0x100bf60
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
call dword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x10415f1
movzx eax, ax
mov dword [ebp - 0x818], eax
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x10415f1
test dword [eax + 0x1c], 0x100
je 0x10415f1
cmp byte [eax + 0x19], 2
jb 0x10415f1
push dword [ebp - 0x818]
push 0x1009090
push 0x100bf60
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
cmp dword [ebp - 0x818], 0
jne 0x1041692
push dword [ebp + 8]
call fcn.0101ef2d
push dword [ebp - 0x838]
lea ecx, [esi + 0x50]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov dword [esi + 0x20], 0x11
mov byte [ebp - 4], 1
call fcn.0101cb36
push dword [ebp - 0x834]
lea ecx, [esi + 0x60]
call fcn.0101cb36
push dword [ebp - 0x830]
lea ecx, [esi + 0x78]
call fcn.0101cb36
mov eax, dword [ebp - 0x82c]
push dword [ebp - 0x824]
or dword [esi + 0x24], 0x2010
mov dword [esi + 0x9c], eax
mov eax, dword [ebp - 0x828]
lea ecx, [esi + 0x54]
mov dword [esi + 0x3c], eax
call fcn.0101cb36
push dword [ebp - 0x820]
lea ecx, [esi + 0x64]
call fcn.0101cb36
push dword [ebp - 0x81c]
lea ecx, [esi + 0x58]
call fcn.0101cb36
and dword [ebp - 4], 0
mov dword [esi + 8], 1
lea eax, [ebp - 0x838]
push eax
call sub.FxsCompose.dll_HrFreeDraftsListViewInfo
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42u.dll_CString::CString
mov eax, dword [ebp - 0x818]
call fcn.0101dae9
ret 8
Function at 0x104457d
Capabilities:
Get geographical location

Disassembly:
push 0x38
mov eax, 0x106bac0
call fcn.0101da43
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 0x40], 0
mov edi, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword [0x1077004]
mov esi, 0x1077004
cmp eax, esi
je 0x10445c8
test dword [eax + 0x1c], 0x100
je 0x10445c8
cmp byte [eax + 0x19], 4
jb 0x10445c8
push 0x100c6c0
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
add edi, 4
mov eax, dword [edi]
cdq
mov ecx, 0x15180
idiv ecx
test eax, eax
je 0x10445de
call sub.MFC42u.dll_AfxThrowUserException
push 0x14
lea eax, [ebp - 0x38]
push eax
push 0x1e
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1044654
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1044630
test dword [eax + 0x1c], 0x100
je 0x1044630
cmp byte [eax + 0x19], 2
jb 0x1044630
push dword [ebp - 0x3c]
push 0x1007558
push 0x100c6c0
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
call fcn.01015eea
test eax, eax
je 0x104464f
push 0x90038
push dword [ebp - 0x3c]
push 0x8003
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call sub.MFC42u.dll_AfxThrowResourceException
mov ecx, ebx
call sub.MFC42u.dll_CString::CString_3
mov ecx, dword [edi]
mov eax, ecx
push 0x3c
cdq
pop esi
idiv esi
and dword [ebp - 4], 0
mov dword [ebp - 0x40], 1
imul eax, eax, 0x3c
sub ecx, eax
push ecx
lea eax, [ebp - 0x38]
push eax
mov ecx, edi
call fcn.0104455a
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, edi
call fcn.01044535
push eax
push 0x100c6d0
push ebx
call sub.MFC42u.dll_CString::Format
add esp, 0x1c
mov eax, ebx
call fcn.0101dad5
ret 4