joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b5e0
Capabilities:
Compare security identifiers

Disassembly:
cmp dword [0x101056ec], esi
jne 0x1000b610
lea eax, [ebp - 0x50]
mov dword [ebx], esi
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000b61f
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x1000b630
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000b637
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c]
call fcn.1000640a
mov esi, dword [ebp - 0x4c]
test al, al
je 0x1000b63e
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x1000b64f
push 0x44
pop edi
push edi
lea eax, [ebp - 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1000b656
xor ecx, ecx
mov dword [ebp - 0x58], ecx
test esi, esi
jne 0x1000b65d
jmp 0x1000b673
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1000670c
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1000671e
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x58], ecx
add eax, 8
jmp 0x1000b660
mov dword [ebx], edi
mov dword [0x101056ec], edi
mov eax, dword [ebx]
mov dword [0x101034ac], eax
test esi, esi
je 0x10006760
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
jmp 0x10006760
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x1000674b
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 4
xor esi, esi
jmp 0x1000673a
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], esi
push edi
test ebx, ebx
jne 0x10006629
push 0x15b3c8
jmp 0x1000b624
mov eax, dword [0x101034ac]
xor edi, edi
mov dword [ebx], eax
inc edi
jmp 0x1000673a
push 0x15b3c9
call fcn.1008ee44
mov edi, esi
jmp 0x1000673a
push 0x15b3ca
jmp 0x1000b624
push 0x15b3cb
jmp 0x1000b624
push 0x15b3cc
call fcn.1008ee44
xor edi, edi
jmp 0x1000672d
push 0x15b3cd
jmp 0x1000b643
push 0x15b3ce
jmp 0x1000b643
lea eax, [esi + 4]
xor edi, edi
mov dword [ebp - 0x4c], eax
inc edi
cmp ecx, dword [esi]
jb 0x100066ed
jmp 0x10006720
xor ecx, ecx
mov dword [0], 1
int 0x29

Function at 0x1000df5f
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1000df9a
Function at 0x1000fc38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
invalid
invalid
invalid

Function at 0x100100bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, 0x60
mov ebp, esp
add ebp, 0x24
push esp
call fcn.1000df1f
push edi
or eax, 0xa164d044
xor byte [eax], al
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x100100e3
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1000df1f
mov eax, dword [0x8b8819cd]
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.1000df1f
invalid

Function at 0x10011c7f
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10011c8c
lea esi, [ecx - 0x90]
jmp 0x10011c8e
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp dword [esi + 0x60], 0
je 0x10011cab
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x1001ebaa
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
Function at 0x10029b36
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x10029c57
mov edx, dword [ebp + 0x14]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
inc eax
sub eax, esi
mov dword [ebp + 8], eax
push 2
pop eax
sub eax, esi
mov dword [ebp - 4], eax
lea eax, [edi + esi]
movzx eax, byte [eax]
shr eax, 2
movzx ecx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [edx]
mov word [eax], cx
lea ecx, [edi + esi]
mov eax, dword [ebp + 8]
add dword [edx], 2
add eax, ecx
cmp eax, ebx
je 0x10029c23
mov al, byte [ecx]
and al, 3
shl al, 4
movzx ecx, al
movzx eax, byte [edi + esi + 1]
shr eax, 4
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [edx]
mov word [ecx], ax
lea ecx, [edi + esi]
mov eax, dword [ebp - 4]
add dword [edx], 2
add eax, ecx
cmp eax, ebx
mov al, byte [edi + esi + 1]
je 0x10029bff
and al, 0xf
shl al, 2
movzx ecx, al
movzx eax, byte [edi + esi + 2]
shr eax, 6
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [edx]
mov word [ecx], ax
add dword [edx], 2
movzx eax, byte [edi + esi + 2]
add edi, 3
mov ecx, dword [edx]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
add dword [edx], 2
cmp edi, ebx
jae 0x10029c56
jmp 0x10029b60
mov ecx, dword [edx]
and al, 0xf
shl al, 2
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
add dword [edx], 2
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x10029c56
push 0x3d
pop ecx
jmp 0x10029c50
mov al, byte [edi + esi]
mov ecx, dword [edx]
and al, 3
shl al, 4
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
add dword [edx], 2
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x10029c56
push 0x3d
pop ecx
mov word [eax], cx
add dword [edx], 2
mov eax, dword [edx]
mov word [eax], cx
add dword [edx], 2
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002f2dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100a0e05
call fcn.10002f71
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x410]
xor ebx, ebx
mov dword [ebp - 0x420], ecx
xor ecx, ecx
mov dword [ebp - 0x41c], 0x200
mov byte [ebp - 0x418], bl
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], ebx
mov word [ebp - 0x40c], cx
lea ecx, [ebp - 0x420]
mov dword [ebp - 4], ebx
push ecx
push eax
call fcn.1002daaa
lea eax, [ebp - 0x420]
push eax
call fcn.10027c7b
cmp eax, 0x104
jbe 0x1002f366
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov word [eax + 0x208], cx
mov eax, dword [ebp - 0x420]
mov dword [eax - 4], 0x208
mov byte [ebp - 0x418], bl
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [ebp - 0x420]
push eax
mov ecx, eax
setne bl
call fcn.100073a8
mov al, bl
call fcn.10003491
ret 4

Function at 0x1002fdc0
Capabilities:
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100a0e05
call fcn.10002f71
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x410]
mov edi, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x420], ecx
xor ecx, ecx
mov dword [ebp - 0x41c], 0x200
mov byte [ebp - 0x418], dl
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov word [ebp - 0x40c], cx
lea ecx, [ebp - 0x420]
mov dword [ebp - 4], edx
push ecx
push eax
call fcn.1002daaa
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
test edi, edi
je 0x1002fe34
mov ecx, esi
shr ecx, 4
and cl, 1
mov byte [edi], cl
lea eax, [ebp - 0x420]
push eax
mov ecx, eax
call fcn.100073a8
cmp esi, 0xffffffff
setne al
call fcn.10003491
ret 8
Function at 0x1002fe50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x1002ffc4
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1002fe86
mov eax, dword [ebp + 0xc]
jmp 0x1002feae
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x1002fea3
call edi
push eax
push 0x2e6e7771
call fcn.1003cf9b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x1002fece
call edi
push eax
push 0x2e6e7772
call fcn.1003cf9b
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 0xa
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x18]
push eax
push 0x18
push dword [esi]
call ebx
test eax, eax
jne 0x1002fef5
call edi
push eax
push 0x2e6e7773
call fcn.1003cf9b
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 5
mov dword [esi + 0x30], eax
lea eax, [esi + 0x48]
push eax
push 0x16
push dword [esi]
call ebx
test eax, eax
jne 0x1002ff1c
call edi
push eax
push 0x2e6e7774
call fcn.1003cf9b
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x34], eax
lea eax, [esi + 0x52]
push eax
push 0x17
push dword [esi]
call ebx
test eax, eax
jne 0x1002ff3f
call edi
push eax
push 0x2e6e7775
call fcn.1003cf9b
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x38], eax
lea eax, [ebp - 0x18]
push eax
push 0x1c
push dword [esi]
call ebx
test eax, eax
jne 0x1002ff62
call edi
push eax
push 0x2e6e7776
call fcn.1003cf9b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x3c], eax
lea eax, [ebp - 0x18]
push eax
push 0x1b
push dword [esi]
call ebx
test eax, eax
jne 0x1002ff8d
call edi
push eax
push 0x2e6e7777
call fcn.1003cf9b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 7
mov dword [esi + 0x40], eax
lea eax, [esi + 0x5c]
push eax
push 0x14
push dword [esi]
call ebx
test eax, eax
jne 0x1002ffb8
call edi
push eax
push 0x2e6e7778
call fcn.1003cf9b
lea eax, [esi + 0x5c]
mov byte [esi + 0xa], 1
pop edi
mov dword [esi + 0x44], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001550
mov esp, ebp
pop ebp
ret 8
Function at 0x1002ffd5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x1003014d
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1003000b
mov eax, dword [ebp + 0xc]
jmp 0x10030033
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x10030028
call edi
push eax
push 0x2e6e776a
call fcn.1003cf9b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x10030053
call edi
push eax
push 0x2e6e776b
call fcn.1003cf9b
movzx eax, word [ebp - 0x18]
push 0x30
pop ecx
sub eax, ecx
push 0xa
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
push dword [esi]
call ebx
mov dword [ebp - 0x1c], eax
test eax, eax
jg 0x10030082
call edi
push eax
push 0x2e6e776c
call fcn.1003cf9b
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [esi + 0x18], edx
cmp eax, 2
jl 0x100300d3
add eax, 0xfffffffe
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x100300b7
cmp word [ebp + edx*2 - 0x18], 0x3b
je 0x100300b2
imul ecx, dword [esi + 0x18], 0xa
movzx eax, word [ebp + edx*2 - 0x18]
add ecx, 0xffffffd0
add eax, ecx
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x1c]
inc edx
cmp edx, eax
jl 0x10030096
movzx eax, word [ebp + eax*2 - 0x18]
push 0x30
pop ecx
cmp ax, cx
je 0x100300d3
imul ecx, dword [esi + 0x18], 0xa
add ecx, 0xffffffd0
add eax, ecx
imul eax, eax, 0xa
mov dword [esi + 0x18], eax
push 5
lea eax, [esi + 0x48]
push eax
push 0xe
push dword [esi]
call ebx
test eax, eax
jne 0x100300f0
call edi
push eax
push 0x2e6e776d
call fcn.1003cf9b
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x52]
push eax
push 0xf
push dword [esi]
call ebx
test eax, eax
jne 0x10030113
call edi
push eax
push 0x2e6e776e
call fcn.1003cf9b
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x18]
push eax
push 0x1010
push dword [esi]
call ebx
test eax, eax
jne 0x10030139
call edi
push eax
push 0x2e6e776f
call fcn.1003cf9b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
pop edi
mov dword [esi + 0x24], eax
mov byte [esi + 0xa], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001550
mov esp, ebp
pop ebp
ret 8
Function at 0x100305d8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x100a1d93
call fcn.10002f71
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x23c], 0x100b5c70
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov word [ebp - 0x224], bx
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 1
push eax
call fcn.100370fa
mov edi, dword [ebp + 8]
xor edx, edx
lea eax, [ebp - 0x244]
mov dword [ebp - 0x220], 0x105
push eax
push edx
push edx
push edx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc ebx
cmp eax, 0x103
jne 0x10030688
push 0x80004005
push 0x2e6e3162
jmp 0x100306a6
test eax, eax
je 0x100306ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
push ecx
push 0x2e6e3163
call fcn.1003cf9b
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10006bb7
push 0x20019
lea ecx, [ebp - 0x23c]
call fcn.10006cd2
push eax
lea ecx, [ebp - 0x23c]
call fcn.10006dab
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.10038e40
mov eax, dword [esi]
push 0
pop edx
cmp eax, dword [edi]
jne 0x10030645
lea eax, [edi + 4]
cmp word [eax], dx
je 0x10030742
lea ecx, [esi + 4]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10030732
test dx, dx
je 0x1003072c
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10030732
add ecx, 4
add eax, 4
test dx, dx
jne 0x1003070a
xor edx, edx
mov eax, edx
jmp 0x10030739
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
je 0x10030792
jmp 0x10030645
mov eax, dword [esi + 0x54]
cmp eax, dword [edi + 0x54]
jne 0x10030645
mov eax, dword [esi + 0xa8]
cmp eax, dword [edi + 0xa8]
jne 0x10030645
mov ecx, edx
mov eax, dword [esi + ecx*4 + 0x44]
cmp eax, dword [edi + ecx*4 + 0x44]
jne 0x10030645
inc ecx
cmp ecx, 4
jne 0x10030762
mov ecx, edx
mov eax, dword [esi + ecx*4 + 0x98]
cmp eax, dword [edi + ecx*4 + 0x98]
jne 0x10030645
inc ecx
cmp ecx, 4
jne 0x10030778
lea ecx, [ebp - 0x23c]
call fcn.100073c5
lea ecx, [ebp - 0x250]
call fcn.10006d98
call fcn.10003491
ret 8

Function at 0x100319df
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 8]
push eax
push 0x20001009
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [ebp - 8]
cmp eax, 8
ja 0x10031a23
je 0x10031a28
test eax, eax
je 0x10031a28
cmp eax, 5
jbe 0x10031a2b
cmp eax, 6
je 0x10031a28
cmp eax, 7
jne 0x10031a28
jmp 0x10031a2b
cmp eax, 0xc
jbe 0x10031a2b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret
Function at 0x10031aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAeDebug
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10031b08
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
push ebx
push str.Debugger
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 8

Function at 0x10031c83
Capabilities:
Get geographical location

Disassembly:
push 0x108
mov eax, 0x100a1f9e
call fcn.10002f71
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x110]
push 0x80
push eax
push 2
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
lea ecx, [ebp - 0x110]
test eax, eax
cmovle ecx, edx
push ecx
lea ecx, [ebp - 0x114]
call fcn.10006b9f
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
call fcn.10006c2b
mov eax, esi
call fcn.10003491
ret 4

Function at 0x10032102
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x24]
test eax, eax
jne 0x1003215f
push 2
lea eax, [ebp - 8]
push eax
push 0x100c
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1003214f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
push ecx
push 0x2e6e756c
call fcn.1003cf9b
movzx eax, word [ebp - 8]
sub eax, 0x2f
push 7
cdq
pop ecx
idiv ecx
lea eax, [edx + 1]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret

Function at 0x10032838
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 8]
push eax
push 0x100d
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1003287e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
push ecx
push 0x2e6e756e
call fcn.1003cf9b
movzx eax, word [ebp - 8]
sub eax, 0x30
sub eax, 0
je 0x1003289c
sub eax, 1
je 0x10032898
sub eax, 1
jne 0x1003289c
mov al, 4
jmp 0x1003289e
mov al, 7
jmp 0x1003289e
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret
Function at 0x100331ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a23fd
mov eax, dword fs:[0]
push eax
mov eax, 0x1060
call fcn.100040f8
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1060], eax
call fcn.10006c2b
push ebx
push dword [ebp - 0x1060]
mov ecx, esi
call fcn.10009238
test al, al
je 0x10033218
test edi, edi
je 0x10033211
mov dword [edi], 1
xor eax, eax
jmp 0x100332c2
mov ecx, esi
call fcn.10006d0c
test al, al
je 0x1003325a
cmp byte [esi + 0x18], 0
je 0x10033255
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x106c]
push eax
call fcn.10041233
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1003caac
lea ecx, [ebp - 0x106c]
call fcn.1002b193
push 2
pop eax
jmp 0x100332c2
push 0x1048
lea eax, [ebp - 0x1058]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x105c], 0x1048
test esi, esi
je 0x10033283
lea eax, [esi + 4]
jmp 0x10033285
xor eax, eax
lea ecx, [ebp - 0x105c]
push ecx
lea ecx, [ebp - 0x1058]
push ecx
push edi
push 0
push dword [ebp - 0x1060]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10006dab
mov esi, eax
test esi, esi
jne 0x100332c0
lea eax, [ebp - 0x1058]
mov ecx, ebx
push eax
call fcn.10006bb7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003467e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.100040f8
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x2010], 0x1000
lea ecx, [ebp - 0x2004]
mov byte [ebp - 0x200c], dl
mov dword [ebp - 0x2014], ecx
xor ecx, ecx
mov word [ebp - 0x2000], cx
lea ecx, [ebp - 0x2014]
push ecx
push eax
mov dword [ebp - 0x2008], edx
mov dword [ebp - 0x2004], edx
call fcn.10036f6b
push dword [ebp - 0x2014]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
xor ecx, ecx
test bl, bl
cmovne ecx, eax
lea eax, [ebp - 0x2014]
mov dword [esi], ecx
mov ecx, eax
push eax
call fcn.100073a8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 4
Function at 0x10035bba
Capabilities:
Get geographical location

Disassembly:
push 0x24
mov eax, 0x100a276f
call fcn.10002f71
push 2
lea eax, [ebp - 0x24]
push eax
push 0x23
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10035c11
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea eax, [ebp - 0x30]
push ecx
push 0x2e6e7664
push eax
call fcn.10041233
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1003caac
lea ecx, [ebp - 0x30]
call fcn.1002b193
cmp word [ebp - 0x24], 0x30
je 0x10035c1c
xor al, al
jmp 0x10035c3a
push 9
lea eax, [ebp - 0x24]
push eax
push 0x28
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10035c18
xor eax, eax
cmp word [ebp - 0x24], ax
setne al
call fcn.10003491
ret 4

Function at 0x10038b97
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov edx, dword [ebp + 8]
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10038c0e
cmp dword [ebp - 8], 1
je 0x10038be6
cmp dword [ebp - 8], 2
je 0x10038be6
push 0xd
pop eax
jmp 0x10038c0e
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x10038c08
test ecx, ecx
je 0x10038c03
test cl, 1
jne 0x10038be1
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x10038be1
jmp 0x10038c08
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 0xc