joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017780
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x10098f00]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x44c], ecx
mov word [ebp - 0x440], 0
push 0x206
push 0
lea eax, [ebp - 0x43e]
push eax
call fcn.1005bf00
add esp, 0xc
mov dword [ebp - 0x448], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea ecx, [ebp - 0x234]
push ecx
call fcn.1005bf00
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0xffffffff
jne 0x10017815
jmp 0x100178b3
mov dword [ebp - 0x238], 0x22c
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x444]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10017873
mov ecx, dword [ebp - 0x230]
cmp ecx, dword [ebp - 0x448]
jne 0x1001785c
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x440]
push eax
call fcn.1005be7e
add esp, 8
jmp 0x10017873
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x444]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10017836
cmp dword [ebp - 0x444], 0xffffffff
je 0x10017889
mov eax, dword [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x440]
push ecx
call fcn.1005e155
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x44c]
add eax, 0x1674
push eax
call fcn.1005be7e
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1005b2a2
mov esp, ebp
pop ebp
ret

Function at 0x100178f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
push str._sUpdateDaily_
mov ecx, dword [ebp - 4]
add ecx, 0x187c
push ecx
call fcn.1005c20c
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, 0x187c
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001793a
mov eax, dword [ebp - 4]
add eax, 0x187c
push eax
call fcn.10017b60
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x10017a80
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x10081258
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret
Function at 0x10017af0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret

Function at 0x10017b60
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.1005b570
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10048b54
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1005be7e
add esp, 8
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x10017bca
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jg 0x10017c38
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x5c
jne 0x10017c36
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov cx, word [eax + edx*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov word [eax + edx*2], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10017c1f
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10017c1f
mov byte [ebp - 1], 0
jmp 0x10017c38
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10017bc1
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.10048b59
add esp, 4
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x10019690
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10098f00]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100196d5
xor eax, eax
jmp 0x100197d4
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.1005bf00
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x100813cc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100197b2
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [ebp - 0x428], 0
push 0x206
push 0
lea edx, [ebp - 0x426]
push edx
call fcn.1005bf00
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x428]
push ecx
call fcn.1005be54
add esp, 8
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10019798
xor eax, eax
jmp 0x100197d4
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1005be7e
add esp, 8
mov eax, 1
jmp 0x100197d4
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1005be7e
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005b2a2
mov esp, ebp
pop ebp
ret
Function at 0x100197f0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x10098f00]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov word [ebp - 0x448], 0
push 0x206
push 0
lea eax, [ebp - 0x446]
push eax
call fcn.1005bf00
add esp, 0xc
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.1005bf00
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x44c], 1
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
push 0x10081410
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x100198c3
xor eax, eax
jmp 0x10019a20
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push 0x1008141c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x100198f6
xor eax, eax
jmp 0x10019a20
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push 0x10081428
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x1001992c
xor eax, eax
jmp 0x10019a20
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x10081444
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x448]
push ecx
call fcn.1005e155
add esp, 4
mov dword [ebp - 0x224], eax
push 0x10081448
mov edx, dword [ebp - 0x224]
push edx
call fcn.10015960
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x100199b9
xor eax, eax
jmp 0x10019a20
mov eax, dword [ebp - 0x450]
add eax, 2
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x238], ecx
push 0x1008144c
mov edx, dword [ebp - 0x224]
push edx
call fcn.10015960
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x100199fb
xor eax, eax
jmp 0x10019a20
mov eax, dword [ebp - 0x450]
mov word [eax], 0
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10019a1b
xor eax, eax
jmp 0x10019a20
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005b2a2
mov esp, ebp
pop ebp
ret
Function at 0x10019c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x10098f00]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov word [ebp - 0x440], 0
push 0x206
push 0
lea eax, [ebp - 0x43e]
push eax
call fcn.1005bf00
add esp, 0xc
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.1005bf00
add esp, 0xc
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0x444], 1
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
push str.htmlfile
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x10019ce3
xor eax, eax
jmp 0x10019dd7
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push str.shell
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x10019d16
xor eax, eax
jmp 0x10019dd7
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push str.opencommand
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x10019d4c
xor eax, eax
jmp 0x10019dd7
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 0xc], 1
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x100814d4
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x440]
push ecx
call fcn.1005e155
add esp, 4
mov dword [ebp - 0x224], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.10015960
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10019dd2
xor eax, eax
jmp 0x10019dd7
mov eax, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1005b2a2
mov esp, ebp
pop ebp
ret
Function at 0x10019f30
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x10098f00]
xor eax, ebp
mov dword [ebp - 0x40], eax
push 0x7d0
lea eax, [ebp - 0xfe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
lea ecx, [ebp - 0xfd4]
push ecx
call fcn.1005be7e
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xfe0]
push eax
call fcn.1005be54
add esp, 8
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.1005bf00
add esp, 0xc
mov dword [ebp - 0x30], 0x10081580
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x1008158c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x10019fd2
lea ecx, [ebp - 0xfe0]
push ecx
call fcn.1001a080
add esp, 4
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.1005b2a2
mov esp, ebp
pop ebp
ret

Function at 0x1001a080
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x10098f00]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.1005bf00
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.1005bf00
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x100815b0
lea eax, [ebp - 0x7d8]
push eax
call fcn.1005c20c
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1001a10a
jmp 0x1001a124
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b2a2
mov esp, ebp
pop ebp
ret
Function at 0x1001a300
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x10098f00]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x1001a320
xor eax, eax
jmp 0x1001a3dd
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.1005bf00
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1001a364
xor eax, eax
jmp 0x1001a3dd
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1001a3d1
mov eax, dword [ebp + 8]
push eax
call fcn.1005ed88
add esp, 4
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.1005ed88
add esp, 4
push eax
call fcn.1005eb9c
add esp, 8
test eax, eax
jne 0x1001a3bd
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
jmp 0x1001a3dd
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1001a382
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1005b2a2
mov esp, ebp
pop ebp
ret

Function at 0x1001ce20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, dword [ebp - 4]
mov dword [eax + 4], edx
mov esp, ebp
pop ebp
ret 4

Function at 0x10021750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
push str.__d_
mov edx, dword [ebp - 8]
push edx
call fcn.10021c20
add esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x1002178d
mov eax, 1
jmp 0x1002181a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x80], ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.10020fb0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x7c], 0
jle 0x100217cd
mov ecx, dword [ebp - 8]
call fcn.10020ff0
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx + 0x7c]
jle 0x100217cd
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x7c]
push eax
mov ecx, dword [ebp - 8]
call fcn.10020fb0
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10021040
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x100218f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x14], 0
je 0x10021811
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0xffffffff
jne 0x10021815
xor eax, eax
jmp 0x1002181a
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10021820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
jne 0x10021839
mov eax, 1
jmp 0x100218e6
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x80], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.10020fb0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x7c], 0
jle 0x1002187a
mov ecx, dword [ebp - 0xc]
call fcn.10020ff0
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx + 0x7c]
jle 0x1002187a
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x7c]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.10020fb0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.10021040
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x10021910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x14], 0
je 0x100218be
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0xffffffff
jne 0x100218c2
xor eax, eax
jmp 0x100218e6
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x14], 0xffffffff
jne 0x100218cf
xor eax, eax
jmp 0x100218e6
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x10021ad0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10021af3
xor eax, eax
jmp 0x10021af8
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10021b00
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10021b23
xor eax, eax
jmp 0x10021b28
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10021b30
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
je 0x10021b75
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], 0
mov ecx, dword [ebp - 8]
call fcn.100201d0
mov edx, dword [ebp - 8]
cmp dword [edx + 0x13c], 0
je 0x10021bac
mov eax, dword [ebp - 8]
cmp dword [eax + 0x13c], 0xffffffff
je 0x10021bac
mov ecx, dword [ebp - 8]
add ecx, 0x138
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x138]
mov edx, dword [eax + 0x4c]
call edx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14c], 0
je 0x10021bdb
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14c], 0xffffffff
je 0x10021bdb
mov ecx, dword [ebp - 8]
add ecx, 0x148
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x148]
mov edx, dword [eax + 0x4c]
call edx
mov esp, ebp
pop ebp
ret
Function at 0x10025080
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100794ee
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x10098f00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x24]
call fcn.1004c1bc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1004b241
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
push 0
push 0x9001
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x24]
call fcn.1004c601
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x10025158
cmp dword [ebp + 0xc], 0
jle 0x10025158
mov eax, dword [ebp + 0xc]
cdq
push edx
push eax
lea ecx, [ebp - 0x24]
call fcn.1004c07d
mov dword [ebp - 0x30], 4
push 2
mov eax, dword [ebp - 0x30]
neg eax
cdq
push edx
push eax
lea ecx, [ebp - 0x24]
call fcn.1004bf55
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x34], ecx
jne 0x10025158
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x40]
add eax, 0x7c
push eax
lea ecx, [ebp - 0x24]
call fcn.1004bf0a
jmp 0x10025175
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100274c0
cmp dword [ebp - 0x20], 0
je 0x1002519c
cmp dword [ebp - 0x20], 0xffffffff
je 0x1002519c
lea ecx, [ebp - 0x24]
call fcn.1004c15a
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.1004c2b8
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8