joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004115
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10045c8
call fcn.010042f4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100666c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003f2a
cmp eax, esi
jne 0x1003f1d
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003f2d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003f04
xor esi, esi
inc esi
mov eax, dword [0x1006668]
cmp eax, esi
jne 0x1003f40
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003f7b
mov eax, dword [0x1006668]
test eax, eax
jne 0x1003f75
mov dword [0x1006668], esi
push 0x1001188
push 0x100117c
call fcn.01003e81
pop ecx
pop ecx
test eax, eax
je 0x1003f7b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1004045
mov dword [0x10052fc], esi
mov eax, dword [0x1006668]
cmp eax, esi
jne 0x1003f9f
push 0x1001178
push 0x1001170
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006668], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003fac
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006670], ebx
je 0x1003fcd
push 0x1006670
call fcn.01004269
pop ecx
test eax, eax
je 0x1003fcd
push ebx
push 2
push ebx
call dword [0x1006670]
push dword [0x10052e4]
push dword [0x10052e8]
push dword [0x10052e0]
call fcn.010023cf
add esp, 0xc
mov dword [0x10052f8], eax
cmp dword [0x10052ec], ebx
jne 0x100402b
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10052fc], ebx
jne 0x1004039
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10052f8]
call fcn.01004339
ret
call fcn.01004441
jmp 0x1003ee2

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4a43811
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x69f4d66
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10017ff
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
push 4
pop ecx
mov edi, 0x1001804
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1009ab7
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp + 0xc]
push edx
push dword [ebp + 0x18]
push 0
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x10017fb
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x28]
mov esi, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop edi
pop esi
pop ebp
ret 0x18
mov eax, 0x80020001
jmp 0x10017fb

Function at 0x100256a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
lea edx, [ebp - 0x44]
mov eax, 0x10025dc
push edx
mov esi, ecx
mov ecx, dword [0x101701c]
push eax
push ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetClassInfoA]
xor edi, edi
test eax, eax
jne 0x100258a
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x1001d93
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x100853a
push esi
push dword [0x101701c]
push edi
push edi
push 1
push 1
push edi
push edi
push edi
push edi
push dword [ebp - 0x20]
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [esi], eax
cmp eax, edi
je 0x100853a
push ebx
push dword [esi + 0x1c]
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push dword [esi]
lea eax, [ebp - 0x1c]
push eax
call ebx
cmp eax, edi
jne 0x1004aba
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
cmp eax, 0xffffffff
je 0x10025d4
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x10025c2
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
jmp 0x10025d7
Function at 0x1002760
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0xffffffff
push ebx
push esi
push edi
jne 0x100277d
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
mov dword [ebp + 0x10], edi
cmp edi, eax
ja 0x100277d
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 1
jb 0x10027d4
mov eax, dword [ebp + 8]
movzx esi, word [eax]
mov eax, dword [ebp + 0xc]
movzx edi, word [eax]
dec dword [ebp + 0x10]
add dword [ebp + 8], 2
add dword [ebp + 0xc], 2
xor eax, eax
cmp si, di
je 0x10027cf
cmp ax, si
je 0x10027d8
cmp ax, di
je 0x10027dd
push edi
call fcn.01002858
push esi
mov bx, ax
call fcn.01002858
cmp ax, bx
je 0x100277d
cmp di, si
sbb eax, eax
and eax, 2
dec eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp ax, si
jne 0x100277d
xor eax, eax
jmp 0x10027c8
or eax, 0xffffffff
jmp 0x10027c8
xor eax, eax
inc eax
jmp 0x10027c8
Function at 0x10039e5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 4], ebx
cmp byte [esi + 0x23], bl
jne 0x1008769
xor eax, eax
pop esi
pop ebx
leave
ret
push edi
lea edi, [esi + 0x250]
push edi
push 0x1008808
push 0x17
push ebx
push 0x1008818
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, eax
cmp ecx, ebx
jge 0x1008797
sub eax, 0x80040154
neg eax
sbb eax, eax
and eax, ecx
jmp 0x10087ff
mov eax, dword [edi]
mov ecx, dword [eax]
lea edi, [esi + 0x254]
push edi
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jl 0x10087ff
xor eax, eax
cmp byte [esi + 0x23], bl
sete al
lea eax, [eax + eax + 1]
add eax, dword [0x101702c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01003a91
cmp dword [ebp - 4], ebx
jne 0x10087d2
mov eax, 0x80004005
jmp 0x10087ff
mov eax, dword [edi]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
cmp eax, ebx
jl 0x10087ff
cmp byte [esi + 0x24], bl
je 0x10087fd
mov edi, dword [edi]
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
xor eax, eax
pop edi
jmp 0x10039ea

Function at 0x1003b5a
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
cmp byte [reloc.VERSION.dll_GetFileVersionInfoA], bl
je 0x1009568
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x100954d
mov eax, esi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1009561
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1003b5d
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
je 0x100954d
call fcn.0100320b
mov dword [ebp - 8], esp
cmp esp, ebx
jne 0x1009597
mov esi, 0x8007000e
jmp 0x1003b5d
push ebx
push ebx
push edi
push dword [ebp - 8]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x100954d
mov eax, dword [ebp + 0xc]
call fcn.0100320b
mov edi, esp
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x100954d
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
test eax, eax
je 0x100954d
mov eax, dword [ebp - 0xc]
push ebx
push ebx
sub eax, edi
push eax
push edi
push ebx
push ebx
call esi
mov ecx, dword [ebp + 0x10]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov esi, ebx
jmp 0x1003b5d
Function at 0x1003c6e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor eax, eax
lea ebx, [esi + 0x1c]
mov word [ebx], ax
call fcn.01003752
test eax, eax
jl 0x1003cf2
cmp dword [esi + 0x224], 0
je 0x1007c5c
mov eax, dword [esi + 0x228]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, 0x104
cmp eax, edi
jge 0x1007c63
mov eax, dword [esi + 0x228]
push dword [eax]
push edi
push ebx
call fcn.010031bd
add esp, 0xc
push 0x2e
push ebx
call fcn.01003d0d
test eax, eax
je 0x1003cef
push 0xffffffffffffffff
push 0x1003d00
add eax, 2
push eax
call fcn.01002753
test eax, eax
je 0x1007c6e
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01001335
leave
ret
xor eax, eax
jmp 0x1003cf2
push ebx
push 0xcef
jmp 0x1007d2c
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.010031bd
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0100f1e9
mov edi, eax
test edi, edi
jge 0x1007d06
cmp byte [esi + 6], 0
je 0x1007ca4
mov ecx, dword [0x1017010]
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, 0x80070002
jne 0x1007cba
lea edx, [ebp - 0x20c]
push edx
push 0xcee
jmp 0x1007d2c
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
push eax
push edi
call fcn.0100f3f0
push dword [ebp - 0x210]
mov eax, dword [0x1017010]
mov ecx, dword [eax]
lea edx, [ebp - 0x20c]
push edx
mov edx, dword [0x101702c]
push 0xc84
add edx, 0x14
push edx
push eax
call dword [ecx + 0x10]
add esp, 0x14
push dword [ebp - 0x210]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1007d44
cmp edi, 1
jne 0x1003cef
cmp byte [esi + 6], 0
je 0x1007d20
mov ecx, dword [0x1017010]
mov eax, dword [ecx]
call dword [eax + 8]
lea edx, [ebp - 0x20c]
push edx
push 0xd48
mov edx, dword [0x101702c]
mov eax, dword [0x1017010]
mov ecx, dword [eax]
add edx, 0x15
push edx
push eax
call dword [ecx + 0x10]
add esp, 0x10
mov eax, 0x8004ffff
jmp 0x1003cf1
Function at 0x100ee94
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.msvcrt.dll__fileno]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0xc]
pop ecx
test al, 0x82
jne 0x100ede5
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
or dword [esi + 0xc], 0x20
or eax, 0xffffffff
jmp 0x100ef25
test al, 0x40
je 0x100edf7
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x22
jmp 0x100edd9
push ebx
xor ebx, ebx
test al, 1
je 0x100ee10
mov dword [esi + 4], ebx
test al, 0x10
je 0x100ee6b
mov ecx, dword [esi + 8]
and eax, 0xfffffffe
mov dword [esi], ecx
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
and eax, 0xffffffef
or eax, 2
mov dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
test eax, 0x10c
jne 0x100ee73
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ecx, [eax + 0x20]
cmp esi, ecx
je 0x100ee3c
add eax, 0x40
cmp esi, eax
jne 0x100ee4a
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__isatty]
pop ecx
test eax, eax
jne 0x100ee73
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0100cde6
add esp, 0x14
or eax, 0xffffffff
jmp 0x100ef24
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100ee63
test dword [esi + 0xc], 0x108
push edi
je 0x100eef6
mov eax, dword [esi + 8]
mov edi, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov ecx, dword [esi + 0x18]
sub edi, eax
dec ecx
cmp edi, ebx
mov dword [esi + 4], ecx
jle 0x100eea7
push edi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__write]
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x100eeec
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x100eeca
cmp eax, 0xfffffffe
je 0x100eeca
mov edx, dword [sym.imp.msvcrt.dll___pioinfo]
mov ecx, eax
and eax, 0x1f
imul eax, eax, 0x24
sar ecx, 5
add eax, dword [edx + ecx*4]
jmp 0x100eecf
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
test byte [eax + 4], 0x20
je 0x100eeec
push 2
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__lseeki64]
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x100ef12
mov eax, dword [esi + 8]
mov cl, byte [ebp + 8]
mov byte [eax], cl
jmp 0x100ef0d
xor edi, edi
inc edi
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__write]
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
je 0x100ef1b
or dword [esi + 0xc], 0x20
or eax, 0xffffffff
jmp 0x100ef23
mov eax, dword [ebp + 8]
and eax, 0xff
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100f152
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x39c], esi
cmp byte [reloc.VERSION.dll_GetFileVersionInfoA], bl
je 0x100f130
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100f1c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x100f1c8
lea eax, [ebp - 0x394]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x100f1b0
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x100f15d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100f1cd
and eax, 0xffff
or eax, 0x80070000
jmp 0x100f1cd
call fcn.0100320b
mov dword [ebp - 0x398], esp
push ebx
push ebx
push edi
push dword [ebp - 0x398]
push 0xffffffffffffffff
push dword [ebp - 0x39c]
push ebx
push ebx
call esi
test eax, eax
je 0x100f147
push dword [ebp - 0x398]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100f1c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x100f1c8
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x398]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, ebx
je 0x100f1c8
cmp eax, 0xffffffff
je 0x100f1c8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x100f1cd
test al, 0x10
je 0x100f1c0
mov eax, 0x80070002
lea esp, [ebp - 0x3a8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 4
Function at 0x10137ad
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [reloc.VERSION.dll_GetFileVersionInfoA], bl
je 0x1013789
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1013903
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10137c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1013905
and eax, 0xffff
or eax, 0x80070000
jmp 0x1013905
call fcn.0100320b
mov dword [ebp - 0x18], esp
cmp esp, ebx
jne 0x10137d8
mov eax, 0x8007000e
jmp 0x1013905
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x18]
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a5
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a5
call fcn.0100320b
mov dword [ebp - 0x14], esp
cmp esp, ebx
je 0x10137ce
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x14]
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a5
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a5
call fcn.0100320b
mov dword [ebp - 0x10], esp
cmp esp, ebx
je 0x10137ce
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a5
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10138a8
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a5
call fcn.0100320b
mov dword [ebp - 0xc], esp
cmp esp, ebx
je 0x10137ce
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a5
jmp 0x10138bf
push 4
pop eax
call fcn.0100321e
mov eax, esp
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x10137ce
mov byte [eax], bl
mov esi, dword [ebp + 0x18]
lea eax, [esi + 1]
call fcn.0100320b
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x10137ce
push dword [ebp - 0x18]
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push dword [ebp + 0x14]
push edi
push dword [ebp - 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10137a5
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0x18
Function at 0x10138ec
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [reloc.VERSION.dll_GetFileVersionInfoA], bl
je 0x1013789
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1013903
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10137c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1013905
and eax, 0xffff
or eax, 0x80070000
jmp 0x1013905
call fcn.0100320b
mov dword [ebp - 0x18], esp
cmp esp, ebx
jne 0x10137d8
mov eax, 0x8007000e
jmp 0x1013905
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x18]
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a5
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a5
call fcn.0100320b
mov dword [ebp - 0x14], esp
cmp esp, ebx
je 0x10137ce
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x14]
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a5
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a5
call fcn.0100320b
mov dword [ebp - 0x10], esp
cmp esp, ebx
je 0x10137ce
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a5
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10138a8
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a5
call fcn.0100320b
mov dword [ebp - 0xc], esp
cmp esp, ebx
je 0x10137ce
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a5
jmp 0x10138bf
push 4
pop eax
call fcn.0100321e
mov eax, esp
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x10137ce
mov byte [eax], bl
mov esi, dword [ebp + 0x18]
lea eax, [esi + 1]
call fcn.0100320b
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x10137ce
push dword [ebp - 0x18]
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push dword [ebp + 0x14]
push edi
push dword [ebp - 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10137a5
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0x18