joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100036c1
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x100b3a6e
call fcn.10001360
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000374e
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x10003742
xor ecx, ecx
cmp dword [0x1010526c], ecx
sete cl
test ecx, ecx
jne 0x1000374e
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.10002f7a
xor ecx, ecx
mov dword [ebp - 4], edi
push 2
test bl, bl
pop eax
cmovne ecx, eax
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 0x14], ecx
or eax, ecx
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
call fcn.1000a1f4
mov edi, eax
test edi, edi
je 0x10003752
lea ecx, [ebp + 0xf]
call fcn.100034b6
test edi, edi
sete al
call fcn.100013a0
ret 8
push esi
call fcn.100034e6
xor ecx, ecx
test al, al
jmp 0x100036e3
xor al, al
jmp 0x1000373a
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x1000375e
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.10003480
push ebx
test eax, eax
jne 0x1000d64c
call fcn.10002df5
jmp 0x1000372d
mov eax, dword [esi + 0xc]
xor edi, edi
mov ecx, 0x10104f58
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x101033a0], edi
call fcn.100900ea
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp + 8], edi
or eax, dword [ebp - 0x14]
jmp 0x10003715
Function at 0x10006637
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], esi
push edi
test ebx, ebx
je 0x1000b621
cmp dword [0x10105708], esi
jne 0x1000b628
lea eax, [ebp - 0x50]
mov dword [ebx], esi
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000b637
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x1000b648
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000b64f
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c]
call fcn.10006418
mov esi, dword [ebp - 0x4c]
test al, al
je 0x1000b656
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x1000b667
push 0x44
pop edi
push edi
lea eax, [ebp - 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1000b66e
xor ecx, ecx
mov dword [ebp - 0x58], ecx
test esi, esi
jne 0x1000b675
jmp 0x1000b68b
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x10006743
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10006755
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x58], ecx
add eax, 8
jmp 0x1000b678
mov dword [ebx], edi
mov dword [0x10105708], edi
mov eax, dword [ebx]
mov dword [0x101034ac], eax
test esi, esi
je 0x10006797
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
jmp 0x10006797
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x10006782
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 4
xor esi, esi
jmp 0x10006771
push 0x15b3c8
jmp 0x1000b63c
mov eax, dword [0x101034ac]
xor edi, edi
mov dword [ebx], eax
inc edi
jmp 0x10006771
push 0x15b3c9
call fcn.1008f237
mov edi, esi
jmp 0x10006771
push 0x15b3ca
jmp 0x1000b63c
push 0x15b3cb
jmp 0x1000b63c
push 0x15b3cc
call fcn.1008f237
xor edi, edi
jmp 0x10006764
push 0x15b3cd
jmp 0x1000b65b
push 0x15b3ce
jmp 0x1000b65b
lea eax, [esi + 4]
xor edi, edi
mov dword [ebp - 0x4c], eax
inc edi
cmp ecx, dword [esi]
jb 0x10006724
jmp 0x10006757
xor ecx, ecx
mov dword [0], 1
int 0x29
Function at 0x10006e3a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x1009f4b4
call fcn.10002f91
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push ebx
and dword [ebx], 0
push eax
mov dword [ebp - 0x18], eax
call fcn.10006eaa
test al, al
jne 0x1000b98e
mov ecx, esi
call fcn.10006d43
test al, al
jne 0x1000b99f
mov dword [ebp - 0x14], 4
test esi, esi
je 0x10006ea6
lea eax, [esi + 4]
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push 0
push dword [ebp - 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10006de2
call fcn.100034a6
ret 0xc
xor eax, eax
jmp 0x10006e83
test edi, edi
je 0x1000b998
mov dword [edi], 4
xor eax, eax
jmp 0x10006e9e
cmp byte [esi + 0x18], 0
je 0x1000b9cb
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x24]
push eax
call fcn.10041581
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1003cdd4
lea ecx, [ebp - 0x24]
call fcn.1002b592
push 2
pop eax
jmp 0x10006e9e
Function at 0x10009113
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x1009f4b4
call fcn.10002f91
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
call fcn.10006d43
test al, al
jne 0x1000cd34
and dword [ebp - 0x14], 0
test esi, esi
je 0x10009168
lea eax, [esi + 4]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ebx
push ecx
push 0
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10006de2
call fcn.100034a6
ret 0xc
xor eax, eax
jmp 0x10009145
cmp byte [esi + 0x18], 0
je 0x1000cd60
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x24]
push eax
call fcn.10041581
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1003cdd4
lea ecx, [ebp - 0x24]
call fcn.1002b592
push 2
pop eax
jmp 0x10009160

Function at 0x1000916c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a2b26
mov eax, dword fs:[0]
push eax
mov eax, 0x1064
call fcn.100040cc
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x1064], ecx
mov eax, dword [edi]
mov dword [eax - 4], ebx
mov eax, dword [edi]
mov byte [edi + 8], bl
mov word [eax], dx
mov dword [ebp - 0x105c], ebx
lea eax, [ebp - 0x105c]
mov dword [ebp - 4], ebx
push eax
push ecx
mov ecx, esi
call fcn.10009278
test al, al
jne 0x1000ccb6
mov ecx, esi
call fcn.10006d43
test al, al
jne 0x1000ccbe
push 0x1048
lea eax, [ebp - 0x1058]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1060], 0x1048
lea eax, [esi + 4]
test esi, esi
je 0x1000ccfb
lea ecx, [ebp - 0x1060]
push ecx
lea ecx, [ebp - 0x1058]
push ecx
push ebx
push ebx
push dword [ebp - 0x1064]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10006de2
mov ebx, eax
test ebx, ebx
je 0x1000cd02
lea ecx, [ebp - 0x105c]
mov dword [ebp - 4], 4
call fcn.10006c62
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0x105c]
jmp 0x1000cd09
cmp byte [esi + 0x18], 0
push 2
pop ebx
je 0x10009246
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x1070]
push eax
call fcn.10041581
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.1003cdd4
lea ecx, [ebp - 0x1070]
call fcn.1002b592
jmp 0x10009246
mov eax, ebx
jmp 0x10009216
lea eax, [ebp - 0x1058]
push eax
mov ecx, edi
call fcn.1003b254
jmp 0x10009246
Function at 0x1000978e
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a60c2
mov eax, dword fs:[0]
push eax
push edi
mov eax, dword [0x100b7c0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0x7c]
call fcn.10009854
lea ecx, [edi + 0x78]
mov dword [ebp - 4], 2
call fcn.10026d23
lea ecx, [edi + 0x74]
mov dword [ebp - 4], 5
call fcn.10026d23
lea ecx, [edi + 0x70]
mov dword [ebp - 4], 8
call fcn.10026d23
lea ecx, [edi + 0x6c]
mov dword [ebp - 4], 0xb
call fcn.10026d23
lea ecx, [edi + 0x68]
mov dword [ebp - 4], 0xe
call fcn.10026d23
lea ecx, [edi + 0x64]
mov dword [ebp - 4], 0x11
call fcn.10026d23
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x48]
mov dword [ebp - 4], 0x14
call fcn.10026d23
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x14]
call fcn.1000a07d
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0x1a
call fcn.10026d23
jmp 0x1000d151
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000ebb1
Capabilities:
Enumerate pe sections

Disassembly:
adc cl, byte [ebx - 0x24ccefbb]
cmp eax, ebx
je 0x1000f1bc
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.1000e9c3
adc eax, 0xfa52b66
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.1000e9c3
jle 0x1000ebff
movsb byte es:[edi], byte [esi]
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x1000ec1d
ret
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x1000ec17
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x1000ec08
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
invalid
inc ebp
invalid
Function at 0x1000ec82
Capabilities:
Contain obfuscated stackstrings

Disassembly:
les edx, [eax]
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1000ecb1
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1000e9c3
mov al, byte [0x8dc73415]
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x1000f26d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x1000f283
call fcn.1000e988
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
invalid

Function at 0x1001037b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx - 0x6fb5b]
inc dword [eax]
push 1
pop eax
test eax, eax
je 0x10010a69
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
inc dword [ebx - 0x6fb43]
inc dword [eax]
jne 0x1001053e
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
cmp dword [ebp - 0x6fc], 1
jne 0x100105ef
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.1000e9d3
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.1000e934
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x1001093b
cmp dword [ebp - 0x6fc], 2
jne 0x100106ac
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
invalid
movsd dword es:[edi], dword [esi]
clc
invalid
invalid

Function at 0x10011cde
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10011ceb
lea esi, [ecx - 0x90]
jmp 0x10011ced
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp dword [esi + 0x60], 0
je 0x10011d0a
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x1001eedf
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
Function at 0x10029f41
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x1002a062
mov edx, dword [ebp + 0x14]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
inc eax
sub eax, esi
mov dword [ebp + 8], eax
push 2
pop eax
sub eax, esi
mov dword [ebp - 4], eax
lea eax, [edi + esi]
movzx eax, byte [eax]
shr eax, 2
movzx ecx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_:]
mov eax, dword [edx]
mov word [eax], cx
lea ecx, [edi + esi]
mov eax, dword [ebp + 8]
add dword [edx], 2
add eax, ecx
cmp eax, ebx
je 0x1002a02e
mov al, byte [ecx]
and al, 3
shl al, 4
movzx ecx, al
movzx eax, byte [edi + esi + 1]
shr eax, 4
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_:]
mov ecx, dword [edx]
mov word [ecx], ax
lea ecx, [edi + esi]
mov eax, dword [ebp - 4]
add dword [edx], 2
add eax, ecx
cmp eax, ebx
mov al, byte [edi + esi + 1]
je 0x1002a00a
and al, 0xf
shl al, 2
movzx ecx, al
movzx eax, byte [edi + esi + 2]
shr eax, 6
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_:]
mov ecx, dword [edx]
mov word [ecx], ax
add dword [edx], 2
movzx eax, byte [edi + esi + 2]
add edi, 3
mov ecx, dword [edx]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_:]
mov word [ecx], ax
add dword [edx], 2
cmp edi, ebx
jae 0x1002a061
jmp 0x10029f6b
mov ecx, dword [edx]
and al, 0xf
shl al, 2
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_:]
mov word [ecx], ax
add dword [edx], 2
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x1002a061
push 0x3d
pop ecx
jmp 0x1002a05b
mov al, byte [edi + esi]
mov ecx, dword [edx]
and al, 3
shl al, 4
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_:]
mov word [ecx], ax
add dword [edx], 2
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x1002a061
push 0x3d
pop ecx
mov word [eax], cx
add dword [edx], 2
mov eax, dword [edx]
mov word [eax], cx
add dword [edx], 2
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002f697
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100a248e
call fcn.10002f91
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x410]
xor ebx, ebx
mov dword [ebp - 0x420], ecx
xor ecx, ecx
mov dword [ebp - 0x41c], 0x200
mov byte [ebp - 0x418], bl
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], ebx
mov word [ebp - 0x40c], cx
lea ecx, [ebp - 0x420]
mov dword [ebp - 4], ebx
push ecx
push eax
call fcn.1002de62
lea eax, [ebp - 0x420]
push eax
call fcn.10028034
cmp eax, 0x104
jbe 0x1002f721
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov word [eax + 0x208], cx
mov eax, dword [ebp - 0x420]
mov dword [eax - 4], 0x208
mov byte [ebp - 0x418], bl
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [ebp - 0x420]
push eax
mov ecx, eax
setne bl
call fcn.100073e8
mov al, bl
call fcn.100034a6
ret 4

Function at 0x1003017b
Capabilities:
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100a248e
call fcn.10002f91
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x410]
mov edi, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x420], ecx
xor ecx, ecx
mov dword [ebp - 0x41c], 0x200
mov byte [ebp - 0x418], dl
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov word [ebp - 0x40c], cx
lea ecx, [ebp - 0x420]
mov dword [ebp - 4], edx
push ecx
push eax
call fcn.1002de62
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
test edi, edi
je 0x100301ef
mov ecx, esi
shr ecx, 4
and cl, 1
mov byte [edi], cl
lea eax, [ebp - 0x420]
push eax
mov ecx, eax
call fcn.100073e8
cmp esi, 0xffffffff
setne al
call fcn.100034a6
ret 8
Function at 0x1003020b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x1003037f
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x10030241
mov eax, dword [ebp + 0xc]
jmp 0x10030269
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x1003025e
call edi
push eax
push 0x2e6e7771
call fcn.1003d2e5
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x10030289
call edi
push eax
push 0x2e6e7772
call fcn.1003d2e5
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 0xa
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x18]
push eax
push 0x18
push dword [esi]
call ebx
test eax, eax
jne 0x100302b0
call edi
push eax
push 0x2e6e7773
call fcn.1003d2e5
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 5
mov dword [esi + 0x30], eax
lea eax, [esi + 0x48]
push eax
push 0x16
push dword [esi]
call ebx
test eax, eax
jne 0x100302d7
call edi
push eax
push 0x2e6e7774
call fcn.1003d2e5
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x34], eax
lea eax, [esi + 0x52]
push eax
push 0x17
push dword [esi]
call ebx
test eax, eax
jne 0x100302fa
call edi
push eax
push 0x2e6e7775
call fcn.1003d2e5
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x38], eax
lea eax, [ebp - 0x18]
push eax
push 0x1c
push dword [esi]
call ebx
test eax, eax
jne 0x1003031d
call edi
push eax
push 0x2e6e7776
call fcn.1003d2e5
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x3c], eax
lea eax, [ebp - 0x18]
push eax
push 0x1b
push dword [esi]
call ebx
test eax, eax
jne 0x10030348
call edi
push eax
push 0x2e6e7777
call fcn.1003d2e5
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 7
mov dword [esi + 0x40], eax
lea eax, [esi + 0x5c]
push eax
push 0x14
push dword [esi]
call ebx
test eax, eax
jne 0x10030373
call edi
push eax
push 0x2e6e7778
call fcn.1003d2e5
lea eax, [esi + 0x5c]
mov byte [esi + 0xa], 1
pop edi
mov dword [esi + 0x44], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001550
mov esp, ebp
pop ebp
ret 8
Function at 0x10030390
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x10030508
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x100303c6
mov eax, dword [ebp + 0xc]
jmp 0x100303ee
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x100303e3
call edi
push eax
push 0x2e6e776a
call fcn.1003d2e5
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x1003040e
call edi
push eax
push 0x2e6e776b
call fcn.1003d2e5
movzx eax, word [ebp - 0x18]
push 0x30
pop ecx
sub eax, ecx
push 0xa
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
push dword [esi]
call ebx
mov dword [ebp - 0x1c], eax
test eax, eax
jg 0x1003043d
call edi
push eax
push 0x2e6e776c
call fcn.1003d2e5
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [esi + 0x18], edx
cmp eax, 2
jl 0x1003048e
add eax, 0xfffffffe
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x10030472
cmp word [ebp + edx*2 - 0x18], 0x3b
je 0x1003046d
imul ecx, dword [esi + 0x18], 0xa
movzx eax, word [ebp + edx*2 - 0x18]
add ecx, 0xffffffd0
add eax, ecx
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x1c]
inc edx
cmp edx, eax
jl 0x10030451
movzx eax, word [ebp + eax*2 - 0x18]
push 0x30
pop ecx
cmp ax, cx
je 0x1003048e
imul ecx, dword [esi + 0x18], 0xa
add ecx, 0xffffffd0
add eax, ecx
imul eax, eax, 0xa
mov dword [esi + 0x18], eax
push 5
lea eax, [esi + 0x48]
push eax
push 0xe
push dword [esi]
call ebx
test eax, eax
jne 0x100304ab
call edi
push eax
push 0x2e6e776d
call fcn.1003d2e5
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x52]
push eax
push 0xf
push dword [esi]
call ebx
test eax, eax
jne 0x100304ce
call edi
push eax
push 0x2e6e776e
call fcn.1003d2e5
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x18]
push eax
push 0x1010
push dword [esi]
call ebx
test eax, eax
jne 0x100304f4
call edi
push eax
push 0x2e6e776f
call fcn.1003d2e5
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
pop edi
mov dword [esi + 0x24], eax
mov byte [esi + 0xa], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001550
mov esp, ebp
pop ebp
ret 8