joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006030
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e510
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10017100
mov edi, eax
add esp, 4
test edi, edi
je 0x100060dd
push 1
mov dword [ebp - 4], 0
call fcn.10016646
add esp, 4
mov dword [edi + 4], eax
jmp 0x100060df
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.10002d60
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x10053678]
mov ecx, dword [0x1005367c]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006a00
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x100537c0]
push 0x200030
push dword [0x1005373c]
cmp eax, 1
jne 0x10006a2a
push str.Administrative_privileges_required_at_the_first_startup__n_nRight_click_on_application:_Run_as_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10006a15
push str.Privilegios_administrativos_requeridos_na_primeira_inicializa
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10006c60
Capabilities:
Delete registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100525c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10c]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000001
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10006cbc
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x110]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000002
call ebx
test eax, eax
jne 0x10006cf0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
call edi
push dword [ebp - 0x110]
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000002
call ebx
test eax, eax
jne 0x10006d28
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x114]
call edi
push dword [ebp - 0x114]
call esi
lea eax, [ebp - 0x118]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000001
call ebx
test eax, eax
jne 0x10006d5a
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x118]
call edi
push dword [ebp - 0x118]
call esi
lea eax, [ebp - 0x11c]
push eax
push 0xf013f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000002
call ebx
test eax, eax
jne 0x10006d8f
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call edi
push dword [ebp - 0x11c]
call esi
mov eax, dword [0x100537c0]
push 0x200030
push dword [0x1005373c]
cmp eax, 1
jne 0x10006dc1
push str.Anti_Kill___Scan___Administrative_privileges_are_not_allowed_for_this_application__n_nRestart_application_as_single_user_please_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10006dac
push str.Anti_Kill___Scan___Pivilegios_administrativos_n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006de0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x10006dfe
mov dword [0x100536c4], 1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006e51
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10006e4c
mov dword [0x100536c0], 1
mov esp, ebp
pop ebp
ret
call fcn.10006f10
mov esp, ebp
pop ebp
ret
Function at 0x10006f10
Capabilities:
Create thread
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100525c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10006f69
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10006f71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10006f86
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], 0
test esi, esi
jne 0x10006fff
cmp dword [ebp - 0x14], esi
je 0x10006fd9
cmp dword [0x100536c0], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x10006fae
push 0
push 0
push 0
push 0x10007490
push 0
push 0
call esi
cmp dword [0x100536bc], 0
jne 0x10006fee
push 0
push 0
push 0
push fcn.10006a50
push 0
push 0
call esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017143
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x10007020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10017143
mov esp, ebp
pop ebp
ret
push 0x1004dd24
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.100184ad
int3

Function at 0x10007350
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
push 0
push 0
push 0x10007380
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10007aa0
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100525c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100537e4], 1
jne 0x10007ae1
push 0
push 0
push 0
push 0x10007fa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017143
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10007b75
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10007b75
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10007b75
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10007b75
push 0
push 0
push 0
push 0x100075c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017143
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10017143
mov esp, ebp
pop ebp
ret
Function at 0x10007fc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e83d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10017100
mov edi, eax
add esp, 4
test edi, edi
je 0x1000805d
push 1
mov dword [ebp - 4], 0
call fcn.10016646
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000805f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10001620
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x100080ba
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x100080ba
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x100080d6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100080f9
cmp byte [ebp + 0xc], 0
je 0x100080e5
push esi
call fcn.10016adc
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10008105
mov esi, str.ios_base::badbit_set
jmp 0x10008115
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100039e0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.100020f0
push 0x1004d9f0
lea eax, [ebp - 0x28]
push eax
call fcn.100184ad
int3
Function at 0x10008300
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
cmp dword [0x100537d8], 1
je 0x100083c0
jmp fcn.10008540
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x10008463
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_GameGuard_Scan
push eax
call fcn.10001100
add esp, 8
lea eax, [ebp - 0x174]
push str._Not_running_
push dword [0x100536f4]
push eax
call fcn.10001100
add esp, 8
push eax
call fcn.10001100
add esp, 8
lea ecx, [ebp - 0x174]
call fcn.100032c0
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x10008528
lea eax, [ebp - 0x14]
push eax
call fcn.10008ff0
lea eax, [ebp - 0x14]
push eax
call fcn.10008fe0
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push 0x1004120c
push eax
call fcn.10001100
add esp, 0x1c
lea eax, [ebp - 0xc4]
push str._Not_running_
push dword [0x100536f4]
push eax
call fcn.10001100
add esp, 8
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10008320
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10008950
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008970
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008740
push 0
push 0
call esi
pop esi
ret
Function at 0x10009450
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x100094dd
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nFTP_Server_connection_fail_
push eax
call fcn.10001100
add esp, 8
lea ecx, [ebp - 0x174]
call fcn.100032c0
push 2
push 0x100406a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000957d
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.FTP_Server_connection_fail_
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x24
lea ecx, [ebp - 0xc4]
call fcn.100032c0
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
cmp eax, 1
je 0x100095be
cmp eax, 3
je 0x100095be
cmp eax, 4
je 0x100095be
push 0
cmp eax, 2
jne 0x100095b8
push 0
push 0
push 0x100095d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10009600
jmp 0x100095a1
Function at 0x10009630
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x100096bd
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_HTTP_Server_connection_fail_
push eax
call fcn.10001100
add esp, 8
lea ecx, [ebp - 0x174]
call fcn.100032c0
push 2
push 0x100406a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000975d
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.HTTP_Server_connection_fail_
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x24
lea ecx, [ebp - 0xc4]
call fcn.100032c0
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
cmp eax, 1
je 0x1000979e
cmp eax, 3
je 0x1000979e
cmp eax, 4
je 0x1000979e
push 0
cmp eax, 2
jne 0x10009798
push 0
push 0
push 0x100097b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x100097e0
jmp 0x10009781

Function at 0x10009810
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10009950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x10009830
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ea30
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x100525c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x80000000
push 0
push 0
push str.http:__icanhazip.com_
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x1000993d
lea eax, [ebp - 0x44]
push eax
push 0x2f
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x44]
cmp eax, 0x2f
jae 0x10009942
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0xf4]
mov byte [ebp + eax - 0x40], 0
call fcn.10001830
lea eax, [ebp - 0xf4]
mov dword [ebp - 4], 0
push str._nPublic_IP:
push eax
call fcn.10001100
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.10001100
lea eax, [ebp - 0xf4]
push str._n_________Hack_Log___________n_n
push eax
call fcn.10001100
add esp, 0x18
lea ecx, [ebp - 0xf4]
call fcn.100032c0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.10009ba0
lea ecx, [ebp - 0xf4]
call fcn.100026a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017143
mov esp, ebp
pop ebp
ret
call fcn.10009630
call fcn.10017296
int3
Function at 0x1000a060
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003eb3b
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x100525c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x14
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1000a178
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0x1a0]
call fcn.10001830
lea eax, [ebp - 0x1a0]
mov dword [ebp - 4], 0
push str._nComputer_Username:
push eax
call fcn.10001100
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0x1a0]
call fcn.100032c0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1000a168
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0xf0]
call fcn.10001830
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 1
push str._nComputer_Name:
push eax
call fcn.10001100
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0xf0]
call fcn.100032c0
call fcn.10009830
lea ecx, [ebp - 0xf0]
call fcn.100026a0
jmp 0x1000a16d
call fcn.10009830
lea ecx, [ebp - 0x1a0]
call fcn.100026a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017143
mov esp, ebp
pop ebp
ret
Function at 0x1000a660
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x100537c0]
cmp eax, 1
je 0x1000a6ac
cmp eax, 4
je 0x1000a6ac
push 0
cmp eax, 2
jne 0x1000a69c
push 0
push 0
push 0x1000a6e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x1000a696
push 0
push 0
push 0x10002b20
jmp 0x1000a67f
push 0
push 0
push 0
push 0x1000a710
jmp 0x1000a67f

Function at 0x1000a6c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000a610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000a740
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100536cc], 0xb7
jne 0x1000a790
mov eax, dword [0x100537c0]
push 0x200030
push dword [0x1005373c]
cmp eax, 1
jne 0x1000a776
push str.SI_Scan_n_nAnti_kill_active__just_one_Game_instance_allowed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000a761
push str.SI_Scan_n_nO_Sistema_Anti_kill_permite_apenas_uma_instancia_de_jogo_aberta_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x1000a7d0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000ac40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000aa30
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x1000aabd
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nHTTP_Server_connection_fail_
push eax
call fcn.10001100
add esp, 8
lea ecx, [ebp - 0x174]
call fcn.100032c0
push 2
push 0x100406a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000ab6a
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.HTTP_Server_connection_fail_
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x24
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
cmp eax, 1
je 0x1000abab
cmp eax, 3
je 0x1000abab
cmp eax, 4
je 0x1000abab
push 0
cmp eax, 2
jne 0x1000aba5
push 0
push 0
push 0x1000abc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000abf0
jmp 0x1000ab8e

Function at 0x1000ac20
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push fcn.1000a7f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000ac70
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000ac90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret