joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ae90
Capabilities:
Check if file exists
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39D44014
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001aed8
nop
push 0x64
call ebx
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39D44014
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001aec0
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001af09
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001af09
test byte [esp + 0xc], 2
jne 0x1001af09
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1005b21c]
test eax, eax
je 0x1001af1b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001a950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xea60
mov dword [0x1005b21c], eax
call ebx
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x1005ae00]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x1001af40
push 0x1005d350
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005d350
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001af61
lea edi, [esp + 0x10]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001af71
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001af90
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004a0f8]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [eax], ecx
mov cl, byte [0x1004a0fc]
mov dword [eax + 4], edx
lea edx, [esp + 0x10]
push edx
mov byte [eax + 8], cl
call ebx
test eax, eax
je 0x1001b067
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1005ae00]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x1001afd0
push 0x1005d350
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005d350
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001aff1
lea edi, [esp + 0x10]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001b001
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001b020
mov ecx, dword [str.path.txt]
mov edx, dword [0x1004a380]
mov dword [eax], ecx
mov cl, byte [0x1004a384]
mov dword [eax + 4], edx
lea edx, [esp + 0x10]
push edx
mov byte [eax + 8], cl
call ebx
test eax, eax
jne 0x1001b067
push 0x1005d350
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1004a4e4
push 0x1005d350
call fcn.10011c80
call fcn.1001ae90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x1001c252
xor eax, eax
pop ebx
pop ebp
ret 4
cmp dword [0x1005b100], 0
push esi
push edi
jne 0x1001c415
cmp dword [0x1005b110], 0
je 0x1001c415
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.self.cer
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x1001c301
push str.crypto_
push ebx
call esi
test eax, eax
je 0x1001c2a0
push 0x10046658
inc eax
push eax
call esi
mov edi, eax
test edi, edi
je 0x1001c2a0
inc edi
jmp 0x1001c301
push 0x10046658
push ebx
call esi
mov edi, eax
test edi, edi
je 0x1001c2e5
push str.crypto
inc edi
push edi
call esi
mov edi, eax
test edi, edi
je 0x1001c2e5
push 0x10046658
inc edi
push edi
call esi
mov edi, eax
test edi, edi
je 0x1001c2e5
push str.private_
push ebx
inc edi
call esi
test eax, eax
jne 0x1001c301
push str.public_
push ebx
call esi
test eax, eax
jne 0x1001c301
push str.private_
push ebx
call esi
test eax, eax
jne 0x1001c301
push str.public_
push ebx
call esi
test eax, eax
je 0x1001c415
push str.microscrypto_
push ebx
call esi
test eax, eax
jne 0x1001c415
push str.maxthon3public_
push ebx
call esi
test eax, eax
jne 0x1001c415
push str.microsoftcrypto_
push ebx
call esi
test eax, eax
jne 0x1001c415
push str.crypto_pro_
push ebx
call esi
test eax, eax
jne 0x1001c415
push str.progra1crypto1_
push ebx
call esi
test eax, eax
jne 0x1001c415
push str._temporary_internet_files_
push ebx
call esi
test eax, eax
jne 0x1001c415
push str.:userspublic
push ebx
call esi
test eax, eax
jne 0x1001c415
push 0x1004a68c
push ebx
call esi
test eax, eax
je 0x1001c38d
push 0x10046658
push eax
call esi
test eax, eax
jne 0x1001c415
push str.cryptokit_
push ebx
call esi
test eax, eax
jne 0x1001c415
push str.:progra1common1crypto1
push ebx
call esi
test eax, eax
jne 0x1001c415
xor esi, esi
cmp edi, esi
je 0x1001c3f9
push esi
push esi
push ebx
push 0x1001aab0
push esi
push esi
mov dword [0x1005b100], 1
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x1001c3ed
lea ecx, [ebp + 8]
push ecx
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001c3ed
test byte [ebp + 8], 2
jne 0x1001c3ed
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
push esi
push esi
push ebx
push 0x1001a370
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x1001c3ed
lea eax, [ebp + 8]
push eax
jmp 0x1001c3d2
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x1001c420
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [0x1005b110], 0
jne 0x1001c63c
cmp dword [0x1005b108], 0
je 0x1001c5e0
cmp dword [0x1005b114], 0
je 0x1001c5d7
mov ecx, dword [ebp + 8]
push 0x1004a6c4
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001c5d7
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1001c490
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005d350
call ebx
mov eax, 0x1005d350
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001c4b6
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001c4c8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x1005d350
rep movsb byte es:[edi], byte [esi]
call ebx
mov eax, 0x1005d350
call fcn.10003220
lea esi, [ebp - 0x110]
call fcn.10005b10
mov eax, esi
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001c500
mov edx, dword [str.pass.log]
mov ecx, dword [0x1004a0f8]
mov dword [eax], edx
mov dl, byte [0x1004a0fc]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1001c5d7
lea eax, [ebp - 0x110]
call fcn.100054f0
mov esi, eax
cmp esi, 0xffffffff
je 0x1001c5d7
mov edx, dword [0x1005b114]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001c558
sub eax, edi
push edx
mov edi, eax
call fcn.100057b0
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
call fcn.100057b0
call fcn.10005510
mov esi, dword [0x1005b114]
call fcn.10012460
push 0
push 0
push 0
push 0x10019bc0
push 0
push 0
mov dword [0x1005b108], 0
mov dword [0x1005b110], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001c5d7
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001c5d7
test byte [ebp - 4], 2
jne 0x1001c5d7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1005b108], 0
jne 0x1001c63c
mov edi, dword [ebp + 8]
cmp dword [edi], 0x54534f50
jne 0x1001c645
cmp byte [edi + 4], 0x20
jne 0x1001c645
push str.bsi.dll
push edi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x1001c645
mov esi, dword [0x1005b114]
mov dword [0x1005b108], 1
test esi, esi
je 0x1001c61d
call fcn.10012460
mov esi, dword [ebp + 0xc]
lea ecx, [esi + 1]
call fcn.10012420
mov dword [0x1005b114], eax
test eax, eax
je 0x1001c63c
push esi
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov dword [0x1005b108], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001c660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
test esi, esi
je 0x1001c7e9
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001c672
push 0
sub eax, edx
push eax
push esi
call fcn.100441b0
cmp eax, dword [0x1005b324]
je 0x1001c7e9
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push edi
push 0x1004a6d0
push esi
mov dword [0x1005b324], eax
call ebx
mov edi, eax
test edi, edi
je 0x1001c6b7
push str.cvv
push esi
call ebx
test eax, eax
je 0x1001c6f3
push 0x1004a6e0
push esi
call ebx
mov edi, eax
test edi, edi
je 0x1001c6d1
push str.cvv2
push esi
call ebx
test eax, eax
je 0x1001c6f3
push 0x1004a6f0
push esi
call ebx
mov edi, eax
test edi, edi
je 0x1001c7e7
push str.cvc
push esi
call ebx
test eax, eax
jne 0x1001c7e7
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push str.domainletitbit.net
push esi
call ebx
add esp, 8
test eax, eax
jne 0x1001c7e7
push 0x10049e3c
push edi
call ebx
add esp, 8
test eax, eax
je 0x1001c7e7
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x30
jl 0x1001c7e7
cmp cl, 0x39
jg 0x1001c7e7
mov cl, byte [eax + 1]
cmp cl, 0x30
jl 0x1001c7e7
cmp cl, 0x39
jg 0x1001c7e7
mov al, byte [eax + 2]
cmp al, 0x30
jl 0x1001c7e7
cmp al, 0x39
jg 0x1001c7e7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001c762
sub eax, edx
lea edi, [eax + 1]
test edi, edi
je 0x1001c7e7
add edi, 0x13
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1001c7e7
push edi
push 0
push ebx
call sub.MSVCRT.dll_memset
mov edx, ebx
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001c7a0
push 0
push 0
push ebx
push 0x1001c7f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001c7e7
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001c7e7
test byte [ebp - 4], 2
jne 0x1001c7e7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001d1a0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1005b32c]
test eax, eax
je 0x1001d1b6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001d050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1005b32c], eax
test eax, eax
je 0x1001d1fb
push esi
lea ecx, [ebp - 4]
push ecx
push eax
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001d1fa
test byte [ebp - 4], 2
jne 0x1001d1fa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001d940
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalAAFEE2BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001d988
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalAAFEE2BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001d970
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001d9bb
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001d9bb
test byte [esp + 0xc], 2
jne 0x1001d9bb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001d550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001da08
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001da08
test byte [esp + 0xc], 2
jne 0x1001da08
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1005d760
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.FAKTURA
push 0x1005d760
call fcn.10011c80
push 0x9c40
call ebx
call fcn.1001d940
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001da40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1001da50
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001da50
push 0x1005d864
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005d864
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001da74
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001da86
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x104]
pop edi
dec eax
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001daa7
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004a0f8]
mov dword [eax], ecx
mov cl, byte [0x1004a0fc]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret

Function at 0x1001dae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [0x1005b334], 0
push esi
mov esi, eax
je 0x1001dafc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1001daf5
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001db03
sub eax, edx
sar eax, 1
je 0x1001db2b
lea ecx, [esi + eax*2 - 2]
movzx edx, word [ecx]
cmp edx, 0x5c
je 0x1001db2b
cmp edx, 0x2f
je 0x1001db2b
sub ecx, 2
dec eax
jne 0x1001db18
push ebx
lea ebx, [esi + eax*2]
test ebx, ebx
jne 0x1001db3b
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0xe
mov eax, str.private
mov ecx, ebx
push edi
jmp 0x1001db50
mov edi, dword [ecx]
cmp edi, dword [eax]
jne 0x1001dc53
sub edx, 4
add eax, 4
add ecx, 4
cmp edx, 4
jae 0x1001db50
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001dc53
mov al, byte [eax + 1]
cmp al, byte [ecx + 1]
jne 0x1001dc53
call fcn.1001da40
test eax, eax
je 0x1001dc53
lea edx, [ebp - 0x208]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001db95
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001dbb0
sub eax, edx
sar eax, 1
je 0x1001dbdb
lea ecx, [ebp + eax*2 - 0x20a]
movzx edx, word [ecx]
cmp edx, 0x5c
je 0x1001dbdb
cmp edx, 0x2f
je 0x1001dbdb
sub ecx, 2
dec eax
jne 0x1001dbc8
lea edi, [ebp + eax*2 - 0x208]
mov eax, str.public
mov edx, edi
sub edx, eax
jmp 0x1001dbf0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001dbf0
lea eax, [ebx + 0xe]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001dc04
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1001dc14
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001dc53
pop edi
mov eax, 1
pop ebx
mov dword [0x1005b334], eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e0e0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1005b338]
test eax, eax
je 0x1001e0f6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001df90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1005b338], eax
test eax, eax
je 0x1001e13b
push esi
lea ecx, [ebp - 4]
push ecx
push eax
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001e13a
test byte [ebp - 4], 2
jne 0x1001e13a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e1d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
xor eax, eax
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
cmp dword [0x1005b33c], eax
jne 0x1001e367
mov edi, dword [ebp + 0xc]
cmp edi, eax
je 0x1001e367
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.java_
push edi
call esi
test eax, eax
jne 0x1001e367
push str.windows_
push edi
call esi
test eax, eax
jne 0x1001e367
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
je 0x1001e287
lea eax, [ebx + ebx]
test eax, eax
je 0x1001e270
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001e26d
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x1001e287
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [esp + 0x10], esi
test esi, esi
je 0x1001e367
push 0x104
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x1001e367
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x18]
push eax
xor esi, esi
push ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x18]
cmp eax, 0x64
jb 0x1001e36a
cmp eax, 0x5000
ja 0x1001e36a
push 1
push esi
push esi
push ebx
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 4
push 0
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 4
push 0
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnlockFile]
test edi, edi
je 0x1001e36a
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, 0x534b4269
sete al
mov dword [esp + 0xc], eax
test eax, eax
je 0x1001e344
mov dword [0x1005b33c], 1
jmp 0x1001e36a
xor edx, edx
mov eax, 0x4b50
cmp cx, ax
setne dl
mov eax, edx
mov dword [esp + 0xc], eax
test eax, eax
je 0x1001e36a
mov dword [0x1005b33c], 1
jmp 0x1001e36a
mov ebx, dword [ebp + 8]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001e3a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1001e3a7
mov eax, dword [esp + 0x10]
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001e830
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001e878
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001e860
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001e8ab
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001e8ab
test byte [esp + 0xc], 2
jne 0x1001e8ab
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001e6e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001e8f8
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001e8f8
test byte [esp + 0xc], 2
jne 0x1001e8f8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1005d968
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.IBANK
push 0x1005d968
call fcn.10011c80
push 0x9c40
call ebx
call fcn.1001e830
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e990
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov edi, eax
mov dword [esp + 0x10], esi
cmp dword [0x1005b344], esi
je 0x1001ea92
cmp dword [0x1005b340], esi
jne 0x1001ea92
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x1001ea92
lea eax, [ebx + 0x13]
and eax, 0xfffffff0
push eax
push 8
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001ea92
mov ecx, dword [esp + 0x14]
push ecx
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x1001ea92
push 1
push 0
push 0
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
push 0
push eax
push edi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea edx, [esp + 0x1c]
push edx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [esp + 0x20], 0
je 0x1001ea92
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrA]
push str.BEGIN_SIGNATURE
push esi
call ebx
test eax, eax
je 0x1001ea92
push str.END_SIGNATURE
push esi
call ebx
test eax, eax
je 0x1001ea92
mov eax, 1
mov dword [0x1005b340], eax
mov dword [esp + 0x10], eax
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test esi, esi
je 0x1001eac7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1001eac7
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret