joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009a81
Capabilities:
Read .ini file

Disassembly:
push 0x2c
mov eax, 0x1005bc8a
call fcn.1003230f
mov esi, ecx
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
call fcn.100013fb
mov ebx, dword [ebp + 0x10]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
push 0x10061424
push str.SixMonthWindow
mov ecx, ebx
call fcn.1000c2e1
push dword [esi + 0x18]
lea edi, [esi + 0x14]
push dword [edi]
lea ecx, [ebp - 0x38]
push ebx
push dword [ebp - 0x24]
call fcn.1000243a
fild dword [esi + 0x20]
mov byte [ebp - 4], 1
fcomp qword [ebp + 8]
fnstsw ax
test ah, 0x41
jne 0x10009c21
fldz
lea eax, [ebp - 0x18]
push eax
fstp qword [ebp - 0x18]
push 0x64
mov ecx, ebx
call fcn.1000b493
test eax, eax
jl 0x10009b4b
call fcn.10023c2a
test eax, eax
je 0x10009b3b
mov esi, 0x268
push esi
call fcn.10023c32
pop ecx
test eax, eax
je 0x10009b3b
fld qword [ebp - 0x18]
push ebx
push ecx
push ecx
fstp qword [esp]
push esi
call fcn.10025237
add esp, 0x10
cmp eax, 2
jne 0x10009b3b
push dword [0x1007b714]
push dword [0x1007b710]
push esi
call fcn.10023c3b
add esp, 0xc
fld qword [ebp - 0x18]
push ecx
push ecx
lea ecx, [ebp - 0x38]
fstp qword [esp]
call fcn.100024c1
fild dword [edi]
fcomp qword [ebp + 8]
fnstsw ax
test ah, 5
jp 0x10009c21
lea ecx, [ebp - 0x38]
call fcn.1000288d
fstp qword [ebp + 8]
push 0x10062074
xor edi, edi
inc edi
push edi
push str.TimeWarpFactor
push str.MagicNumber
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp + 0x10], eax
fild dword [ebp + 0x10]
fmul qword [ebp + 8]
fstp qword [ebp + 8]
call fcn.10023c2a
test eax, eax
je 0x10009bd0
mov esi, 0x269
push esi
call fcn.10023c32
pop ecx
test eax, eax
je 0x10009bd0
fld qword [ebp + 8]
push ebx
push ecx
push ecx
fstp qword [esp]
push esi
call fcn.10025237
add esp, 0x10
cmp eax, 2
jne 0x10009bd0
push dword [0x1007b714]
push dword [0x1007b710]
push esi
call fcn.10023c3b
add esp, 0xc
fldz
lea eax, [ebp - 0x20]
push eax
fstp qword [ebp - 0x20]
push 0x100620dc
push dword [0x10076f10]
mov ecx, ebx
call fcn.1000d00b
test eax, eax
jl 0x10009c21
fldz
fcomp qword [ebp - 0x20]
fnstsw ax
test ah, 5
jp 0x10009c21
fld qword [ebp - 0x20]
fcomp qword [ebp + 8]
fnstsw ax
test ah, 5
jp 0x10009c0b
mov dword [ebp - 0x10], edi
push dword [ebp - 0x10]
mov ecx, ebx
push dword [0x10076f18]
push dword [0x10076f10]
call fcn.1000d346
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.10002493
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10001636
mov eax, dword [ebp - 0x10]
call fcn.100323e7
ret 0xc
Function at 0x10009db0
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x9c
lea ebp, [esp - 4]
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x14
mov eax, 0x1005bd2f
call fcn.1003230f
mov dword [ebp - 0x18], ecx
mov ebx, dword [ebp + 0xa8]
xor esi, esi
mov ecx, ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
call fcn.100013fb
mov dword [ebp - 4], esi
mov esi, 0x9c
push esi
xor edi, edi
lea eax, [ebp]
push 0
inc edi
push eax
mov dword [ebp - 0x1c], edi
call fcn.10031b60
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp + 0x10]
xor esi, esi
sub eax, esi
je 0x10009fb5
dec eax
je 0x10009f7e
dec eax
jne 0x10009fc1
push 0x10062040
mov ecx, ebx
call fcn.10001145
cmp dword [ebp + 4], 5
jne 0x10009e88
cmp dword [ebp + 8], esi
jbe 0x10009e7c
mov eax, 0x200
cmp word [ebp + 0x98], ax
jne 0x10009e60
push 0x10062048
jmp 0x10009e81
mov ecx, dword [ebp - 0x18]
call fcn.10009d48
mov ecx, ebx
test eax, eax
je 0x10009e75
push 0x10062050
jmp 0x10009e83
push 0x1006204c
jmp 0x10009e83
push 0x10062038
mov ecx, ebx
call fcn.10001145
cmp dword [ebp + 4], 6
jne 0x10009fc1
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x100620f4
call fcn.10001432
lea ecx, [ebp - 0x10]
call fcn.100096a4
mov dword [ebp - 4], edi
cmp dword [ebp - 0x10], esi
je 0x10009fc1
push str.GetProductInfo
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
jne 0x10009ee3
cmp dword [ebp - 0x10], esi
je 0x10009fc1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10009fc1
lea ecx, [ebp - 0x14]
push ecx
movzx ecx, word [ebp + 0x96]
push ecx
movzx ecx, word [ebp + 0x94]
push ecx
push dword [ebp + 8]
push dword [ebp + 4]
call eax
test eax, eax
je 0x10009ecc
mov ecx, dword [ebp - 0x18]
call fcn.10009d48
test eax, eax
mov eax, dword [ebp - 0x14]
je 0x10009f41
cmp eax, edi
jne 0x10009f1d
push 0x10062068
jmp 0x10009f72
cmp eax, 2
jne 0x10009f29
push 0x10062058
jmp 0x10009f72
cmp eax, 3
jne 0x10009f35
push 0x10062060
jmp 0x10009f72
cmp eax, 6
jne 0x10009ecc
push 0x10062070
jmp 0x10009f72
cmp eax, edi
jne 0x10009f4c
push 0x10062064
jmp 0x10009f72
cmp eax, 2
jne 0x10009f58
push 0x10062054
jmp 0x10009f72
cmp eax, 3
jne 0x10009f64
push 0x1006205c
jmp 0x10009f72
cmp eax, 6
jne 0x10009ecc
push 0x1006206c
mov ecx, ebx
call fcn.10001145
jmp 0x10009ecc
cmp dword [ebp + 8], esi
jbe 0x10009fac
movzx eax, word [ebp + 0xc]
cmp eax, 0xbb8
jb 0x10009f95
push 0x10062044
jmp 0x10009fba
mov ecx, ebx
cmp eax, 0x8ae
jb 0x10009fa5
push 0x10062034
jmp 0x10009fbc
push 0x10062030
jmp 0x10009fbc
jne 0x10009fc1
push 0x1006202c
jmp 0x10009fba
push 0x1006203c
mov ecx, ebx
call fcn.10001145
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.100302c9
add ebp, 0xa0
leave
ret 4
Function at 0x1000a115
Capabilities:
Get geographical location

Disassembly:
push 0x4c
mov eax, 0x1005bdd1
call fcn.10032378
mov esi, dword [ebp + 8]
mov dword [ebp - 0x58], ecx
xor ebx, ebx
lea ecx, [ebp - 0x3d]
mov dword [ebp - 0x4c], ebx
call fcn.10015308
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x3d]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], ebx
call fcn.100154df
movzx eax, al
push str.countrycode
mov ecx, esi
mov dword [ebp - 0x50], eax
call fcn.10001c79
mov ecx, esi
cmp dword [ebp - 0x44], ebx
je 0x1000a168
push dword [ebp - 0x44]
jmp 0x1000a16d
push 0x10061424
call fcn.10001c79
cmp dword [ebp + 0xc], 1
je 0x1000a182
cmp dword [ebp + 0xc], 2
jne 0x1000a256
xor eax, eax
mov word [ebp - 0x3c], ax
lea edi, [ebp - 0x3a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3d]
mov dword [ebp - 0x48], ebx
call fcn.1001530c
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x3d]
call fcn.100154c7
push 0xa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x4c]
call fcn.100301c9
push 0xa
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x50]
call fcn.100301c9
add esp, 0x18
cmp dword [ebp + 0xc], 1
jne 0x1000a214
push str.timezone
mov ecx, esi
call fcn.10001c79
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.10001c79
push str.location
mov ecx, esi
call fcn.10001c79
push dword [ebp - 0x48]
mov ecx, esi
call fcn.10001c79
push str.languagecode
mov ecx, esi
call fcn.10001c79
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
push eax
call fcn.1000a0aa
push dword [eax + 4]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10001c79
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.10001636
cmp dword [ebp - 0x48], ebx
je 0x1000a256
push dword [ebp - 0x48]
call fcn.1002f915
pop ecx
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x44], ebx
je 0x1000a267
push dword [ebp - 0x44]
call fcn.1002f915
pop ecx
mov dword [ebp - 0x44], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d]
call fcn.1001530b
xor eax, eax
inc eax
call fcn.100323fb
ret 8
Function at 0x1000a667
Capabilities:
Read .ini file

Disassembly:
push 0x24
mov eax, 0x1005bec1
call fcn.10032378
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x28], ecx
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
call fcn.100013fb
push str.http:__
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], 1
call fcn.10001145
push 0x10061f5c
call fcn.10009653
pop ecx
push eax
mov ecx, esi
call fcn.10001c79
push 0x10062410
mov ecx, esi
call fcn.10001c79
push 0x1006240c
mov ecx, esi
call fcn.10001c79
push str.action
mov ecx, esi
call fcn.10001c79
push 0x10062408
mov ecx, esi
call fcn.10001c79
push str.getThreshold_7.5
mov ecx, esi
call fcn.10001c79
push 0x10062074
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str.HutNoJumpstation
mov ebx, str.MagicNumber
push ebx
call edi
test eax, eax
je 0x1000a719
push str.https:__rblb008.sjdc.permedio.net_baldeagle_getThreshold_version3.0
mov ecx, esi
call fcn.10001145
mov ecx, dword [ebp - 0x28]
push 0
push esi
call fcn.1000a115
push 0x10062074
push 0
push str.HutThreshold
push ebx
call edi
mov ebx, eax
test ebx, ebx
je 0x1000a76c
mov byte [ebp - 0x24], 0
xor eax, eax
lea edi, [ebp - 0x23]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.debug
mov ecx, esi
stosb byte es:[edi], al
call fcn.10001c79
push 0xa
lea eax, [ebp - 0x24]
push eax
push ebx
call fcn.1003019f
add esp, 0xc
push eax
mov ecx, esi
call fcn.10001c79
mov eax, esi
call fcn.100323fb
ret 8

Function at 0x1000ae39
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
test edi, edi
je 0x1000ae7c
and dword [ebp + 0x10], 0
push 0x10
call fcn.10032603
pop ecx
test eax, eax
je 0x1000ae64
fld qword [ebp + 8]
mov dword [eax], edi
fstp qword [eax + 8]
mov dword [eax + 4], esi
jmp 0x1000ae66
xor eax, eax
lea ecx, [ebp + 0x10]
push ecx
push 0
push eax
push 0x1000a776
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1000ae84
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
test edi, edi
je 0x1000aec7
and dword [ebp + 0x10], 0
push 0x10
call fcn.10032603
pop ecx
test eax, eax
je 0x1000aeaf
fld qword [ebp + 8]
mov dword [eax], edi
fstp qword [eax + 8]
mov dword [eax + 4], esi
jmp 0x1000aeb1
xor eax, eax
lea ecx, [ebp + 0x10]
push ecx
push 0
push eax
push 0x1000aa5e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1000b364
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d4
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x1000b3f1
cmp dword [esi + 4], 0
je 0x1000b3f1
push 0x7cf
lea eax, [ebp - 0x7d3]
push 0
push eax
mov byte [ebp - 0x7d4], 0
call fcn.10031b60
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x1000b3c7
push edi
lea edi, [ebp + 0xc]
push eax
lea eax, [ebp - 0x7d4]
push eax
call fcn.10031110
add edi, 4
mov eax, dword [edi]
pop ecx
pop ecx
test eax, eax
jne 0x1000b3ae
pop edi
push dword [esi + 4]
lea eax, [ebp - 0x7d4]
push 1
push eax
call fcn.100300d0
pop ecx
push eax
lea eax, [ebp - 0x7d4]
push eax
call fcn.100365b8
push dword [esi + 4]
call fcn.100363fa
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100302c9
leave
ret

Function at 0x1000bd0c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x1000bd20
mov eax, 0x80070057
jmp 0x1000bd5e
push eax
push 1
lea eax, [ebp + 8]
push 1
push eax
call fcn.100365b8
add esp, 0x10
cmp dword [ebp + 0x10], 0
je 0x1000bd5c
push dword [esi + 0x20]
lea eax, [ebp + 0xc]
push 1
push 1
push eax
call fcn.100365b8
push dword [esi + 0x20]
movzx eax, byte [ebp + 0xc]
push eax
push 1
push dword [ebp + 0x10]
call fcn.100365b8
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1000bfee
Capabilities:
Read .ini file

Disassembly:
push esi
push 0x10062578
push 1
push str.NewDataFolderMethod
push str.MagicNumber
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push dword [esp + 8]
test eax, eax
je 0x1000c01d
lea ecx, [esi + 0xb4]
call fcn.10001145
jmp 0x1000c025
lea ecx, [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 8]
xor eax, eax
pop esi
ret 4
Function at 0x10013a17
Capabilities:
Delete file
Move file

Disassembly:
push 0x30
mov eax, 0x1005d237
call fcn.1003230f
mov esi, ecx
lea ecx, [ebp - 0x3c]
call fcn.100013fb
xor ebx, ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.100013fb
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.100013fb
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.1000b5c3
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100018ed
push str.Hpdarc.ini
lea ecx, [ebp - 0x24]
call fcn.10001c79
push str.Hpdarc.txt
lea ecx, [ebp - 0x1c]
call fcn.10001c79
lea eax, [ebp - 0x10]
push eax
push str.SnapshotCount
mov edi, 0x10062684
push edi
mov ecx, esi
call fcn.1000cfb6
lea eax, [ebp - 0x3c]
push eax
push str.upload_status
push 0x100627e8
call fcn.10028f61
add esp, 0xc
test eax, eax
je 0x10013acc
push dword [ebp - 0x38]
call fcn.10032bbe
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
jne 0x10013b71
call fcn.10023c2a
test eax, eax
je 0x10013b08
mov edi, 0x2c2
push edi
call fcn.10023c32
pop ecx
test eax, eax
je 0x10013b08
push ebx
push edi
call fcn.10024822
pop ecx
pop ecx
cmp eax, 2
jne 0x10013b08
push dword [0x1007b714]
push dword [0x1007b710]
push edi
call fcn.10023c3b
add esp, 0xc
cmp dword [ebp - 0x10], 1
mov ecx, esi
jne 0x10013b1d
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push 1
lea eax, [ebp - 0x34]
jmp 0x10013b24
push ebx
lea eax, [esi + 0xd8]
push eax
push 5
call fcn.1000e62f
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
mov ebx, str.TransmissionCount
push ebx
mov edi, 0x100626cc
push edi
mov ecx, esi
call fcn.1000cfb6
dec dword [ebp - 0x10]
push dword [ebp - 0x10]
mov ecx, esi
push ebx
push edi
call fcn.1000d346
jmp 0x10013c06
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10061744
mov ebx, 0x100626ac
push ebx
push edi
mov ecx, esi
call fcn.1000d1c2
call fcn.1000bf56
test eax, eax
jne 0x10013b9d
mov ecx, esi
call fcn.10012a01
mov eax, dword [esi + 0x90]
mov eax, dword [eax]
add esi, 0x78
push esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000e87a
jmp 0x10013be9
lea ecx, [ebp - 0x2c]
call fcn.1000cac7
mov eax, dword [eax + 8]
push 0x10061744
push ebx
push edi
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.1000d1c2
call fcn.1000bf56
test eax, eax
jne 0x10013be1
mov ecx, dword [ebp - 0x10]
call fcn.10012a01
lea ecx, [ebp - 0x2c]
call fcn.1000caf6
mov eax, dword [esi + 0x18]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.1000e87a
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000c898
test al, al
je 0x10013bb4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10001636
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.10001636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10001636
mov eax, dword [ebp - 0x14]
call fcn.100323e7
ret
Function at 0x10013c33
Capabilities:
Delete file
Move file

Disassembly:
push esi
mov esi, ecx
call fcn.100132a3
mov ecx, esi
call fcn.1000c3a1
mov ecx, esi
pop esi
jmp fcn.10013a17

Function at 0x1001411a
Capabilities:
Create thread

Disassembly:
push 0x44
mov eax, 0x1005d2ed
call fcn.10032378
push str.DoUploadCmd
mov esi, ecx
push str.CMarsInstance
lea ecx, [ebp - 0x4c]
call fcn.10024db6
mov eax, dword [esi + 0xd0]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, 0x80004005
cmp eax, ebx
je 0x1001416d
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1001416d
push dword [esi + 0xd0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xd0], ebx
cmp dword [esi + 0xd0], ebx
jne 0x100141d2
push 0xc
mov dword [ebp - 0x50], ebx
call fcn.10032603
pop ecx
cmp eax, ebx
je 0x10014195
movzx ecx, byte [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 8], ecx
jmp 0x10014197
xor eax, eax
lea ecx, [ebp - 0x50]
push ecx
push ebx
push eax
push 0x100140b4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xd0], eax
cmp byte [ebp + 0x10], bl
je 0x100141d0
mov ecx, esi
call fcn.1000b926
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x7fffbffb
add edi, 0x80004005
jmp 0x100141d2
xor edi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10024a7a
mov eax, edi
call fcn.100323fb
ret 0xc
Function at 0x1001507e
Capabilities:
Create process on windows

Disassembly:
push 0x84
mov eax, 0x1005d604
call fcn.1003230f
lea ecx, [ebp - 0x3c]
call fcn.1002762b
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.100013fb
push ebx
mov byte [ebp - 4], 1
call fcn.10031e3f
push edx
push eax
lea eax, [ebp - 0x20]
push 0x1006227c
push eax
call fcn.10001266
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push 0x10062e3c
push eax
call fcn.10001a07
add esp, 0x20
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.100013fb
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.100276c1
lea ecx, [ebp - 0x18]
call fcn.100013fb
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push dword [ebp - 0x1c]
mov byte [ebp - 4], 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.__s____s____s____s____s____s____s____s_
push eax
call fcn.10001266
add esp, 0x28
lea ecx, [ebp - 0x18]
call fcn.10001130
inc eax
push eax
call fcn.1002f7f6
push dword [ebp - 0x14]
mov esi, eax
push esi
call fcn.10031100
push 0x40
lea eax, [ebp - 0x8c]
push ebx
push eax
call fcn.10031b60
mov dword [ebp - 0x4c], ebx
xor eax, eax
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
mov dword [ebp - 0x90], 0x44
call fcn.10023c2a
test eax, eax
je 0x100151a2
mov edi, 0x29f
push edi
call fcn.10023c32
pop ecx
test eax, eax
je 0x100151a2
push esi
push edi
call fcn.100248d5
pop ecx
pop ecx
cmp eax, 2
jne 0x100151a2
push dword [0x1007b714]
push dword [0x1007b710]
push edi
call fcn.10023c3b
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [ebp + 0x20]
setne byte [ebp - 0xd]
cmp eax, ebx
je 0x100151ce
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
push esi
call fcn.100312c8
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001636
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10001636
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.10001636
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.10001636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.1002765d
mov al, byte [ebp - 0xd]
call fcn.100323e7
ret
Function at 0x10015219
Capabilities:
Create process on windows

Disassembly:
push 0x60
mov eax, 0x1005d62a
call fcn.1003230f
lea ecx, [ebp - 0x18]
call fcn.100013fb
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push str.__s____s____s_
push eax
call fcn.10001266
add esp, 0x14
lea ecx, [ebp - 0x18]
call fcn.10001130
inc eax
push eax
call fcn.1002f7f6
push dword [ebp - 0x14]
mov ebx, eax
push ebx
call fcn.10031100
push 0x40
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.10031b60
mov dword [ebp - 0x28], esi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
mov dword [ebp - 0x6c], 0x44
call fcn.10023c2a
test eax, eax
je 0x100152c3
mov edi, 0x29e
push edi
call fcn.10023c32
pop ecx
test eax, eax
je 0x100152c3
push ebx
push edi
call fcn.100248d5
pop ecx
pop ecx
cmp eax, 2
jne 0x100152c3
push dword [0x1007b714]
push dword [0x1007b710]
push edi
call fcn.10023c3b
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [ebp + 0x14]
setne byte [ebp - 0xd]
cmp eax, esi
je 0x100152ec
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
push ebx
call fcn.100312c8
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x18]
call fcn.10001636
mov al, byte [ebp - 0xd]
call fcn.100323e7
ret
Function at 0x1001530c
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x94
lea ebp, [esp - 4]
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x34
mov eax, 0x1005d645
call fcn.10032342
mov esi, dword [ebp + 0xa0]
mov eax, dword [esi]
xor edi, edi
mov dword [ebp - 0x1c], esi
cmp eax, edi
je 0x1001534a
push eax
call fcn.1002f915
pop ecx
mov dword [esi], edi
lea eax, [ebp]
push eax
mov dword [ebp - 4], edi
mov dword [ebp], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10015373
mov dword [ebp - 0x28], edi
push 0x1006f30c
lea eax, [ebp - 0x28]
push eax
call fcn.10032a05
cmp dword [ebp + 4], 6
jae 0x10015392
cmp dword [ebp + 4], 5
jne 0x10015385
cmp dword [ebp + 8], 1
jae 0x10015392
mov dword [ebp - 0x3c], edi
push 0x1006f30c
lea eax, [ebp - 0x3c]
jmp 0x1001536d
push 0x10062edc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, edi
jne 0x100153b3
mov dword [ebp - 0x20], edi
push 0x1006f30c
lea eax, [ebp - 0x20]
jmp 0x1001536d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetUserGeoID
push ebx
call esi
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x100153dc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x38], edi
push 0x1006f30c
lea eax, [ebp - 0x38]
jmp 0x1001536d
push str.GetGeoInfoA
push ebx
call esi
mov ebx, eax
cmp ebx, edi
jne 0x10015409
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x30], edi
push 0x1006f30c
lea eax, [ebp - 0x30]
jmp 0x1001536d
push 0x10
call dword [ebp - 0x14]
push edi
push edi
push edi
push 4
push eax
mov dword [ebp - 0x2c], eax
call ebx
mov esi, eax
cmp esi, edi
jne 0x1001542f
mov dword [ebp - 0x24], edi
push 0x1006f30c
lea eax, [ebp - 0x24]
jmp 0x1001536d
push esi
call fcn.1002f7f6
pop ecx
push edi
push esi
push eax
push 4
push dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
call ebx
cmp eax, edi
jne 0x10015457
mov dword [ebp - 0x34], edi
push 0x1006f30c
lea eax, [ebp - 0x34]
jmp 0x1001536d
inc eax
push eax
call fcn.1002f7f6
pop ecx
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push eax
mov dword [ecx], eax
call fcn.10031100
push dword [ebp - 0x14]
call fcn.100312c8
add esp, 0xc
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.100302c9
add ebp, 0x98
leave
ret 4