joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b20f
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.1007c930
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
test esi, esi
je 0x1003b2cb
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x110c]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1003b2cb
push edi
xor edi, edi
test dword [ebp - 8], 0xfffffffc
jbe 0x1003b2ca
push 0x104
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + edi*4 - 0x110c]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x1003b28b
lea eax, [ebp - 0x10c]
push str.acccore.dll
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1003b298
mov eax, dword [ebp - 8]
inc edi
shr eax, 2
cmp edi, eax
jb 0x1003b257
jmp 0x1003b2ca
cmp byte [0x100d2da8], 0
je 0x1003b2be
lea ecx, [ebp - 1]
call fcn.1003943e
mov esi, eax
mov ecx, esi
call fcn.10022750
push edi
push esi
push 4
call fcn.100546cc
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + edi*4 - 0x110c]
mov dword [eax], ecx
pop edi
pop esi
leave
ret

Function at 0x1003b729
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
xor ebx, ebx
mov ebp, str._AOL_Static
push ebx
push ebp
push ebx
jmp 0x1003b769
push 0x50
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x1003b766
lea eax, [esp + 0xc]
mov byte [esp + 0x5b], bl
push str.AOL_will_never_ask_you_for_your_password_or_billing_information.
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1003b77b
push ebx
push ebp
push esi
push dword [esp + 0x6c]
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
jne 0x1003b73b
jmp 0x1003b77d
mov bl, 1
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x50
ret

Function at 0x1004058d
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push 2
push esi
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
cmovne esi, eax
xor ebx, ebx
push ebx
push str.AOL_Toolbar
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
call esi
test eax, eax
je 0x100405e6
push ebx
push str._AOL_Toolbar
push ebx
push eax
call esi
test eax, eax
je 0x100405e6
push ebx
push str._AOL_Edit
push ebx
push eax
call esi
test eax, eax
je 0x100405e6
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
jmp 0x100405f1
mov eax, dword [esp + 0x10]
mov byte [eax], bl
mov eax, 0x490
pop esi
pop ebx
ret

Function at 0x100405f4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov byte [esi], 0
push dword [0x100d2fe0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10040629
push dword [esp + 8]
call fcn.100404bf
pop ecx
push eax
mov dword [0x100d2fe0], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10040629
inc eax
pop esi
ret
push esi
push dword [esp + 0x14]
push 0xd
push dword [0x100d2fe0]
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
pop esi
ret
Function at 0x100436a9
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x100a31e1
call fcn.1007c8b4
sub esp, 0x14
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x100436c9
mov eax, dword [esi]
mov ebx, dword [sym.imp.WININET.dll_GetUrlCacheEntryInfoA]
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100437cc
cmp dword [ebp - 0x10], 0
je 0x100437cc
push edi
push dword [ebp - 0x10]
call fcn.1007c983
mov edi, eax
pop ecx
test edi, edi
je 0x100437cb
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1004370f
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
push edi
push eax
call ebx
test eax, eax
je 0x100437c4
mov eax, dword [edi + 0x24]
xor ebx, ebx
xor ecx, ecx
or eax, ebx
or ecx, dword [edi + 0x20]
cmp eax, dword [ebp + 0x10]
ja 0x100437c4
jb 0x1004373f
cmp ecx, dword [ebp + 0xc]
jae 0x100437c4
mov eax, dword [edi + 0x34]
xor ecx, ecx
or ecx, dword [edi + 0x30]
or eax, ebx
cmp eax, dword [ebp + 0x10]
jb 0x100437c4
ja 0x10043755
cmp ecx, dword [ebp + 0xc]
jb 0x100437c4
mov eax, 0x100d1590
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.100786c1
mov byte [ebp - 0x14], 1
mov dword [ebp - 4], ebx
mov ebx, 0x100d1584
push esi
mov ecx, ebx
call fcn.1003ba8c
cmp eax, dword [0x100d1584]
jne 0x100437b3
mov eax, dword [0x100d1588]
cmp eax, dword [0x100cb2c8]
jbe 0x10043794
mov ecx, ebx
call fcn.100447b7
push esi
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.1003b983
cmp dword [esi + 0x14], 0x10
jb 0x100437a8
mov esi, dword [esi]
push dword [ebp + 0x14]
push esi
call fcn.100718fd
pop ecx
pop ecx
mov ecx, 0x100d1590
mov dword [ebp - 4], 1
call fcn.100784db
push edi
call fcn.1007c98c
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1004a5e7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x100d231c], 0
jne 0x1004a63f
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push 0x1004932b
push eax
push eax
call fcn.10085aee
add esp, 0x18
test eax, eax
jne 0x1004a635
cmp byte [0x100d2da8], al
je 0x1004a635
push esi
lea ecx, [ebp - 1]
call fcn.10047935
mov esi, eax
mov ecx, esi
call fcn.1004a843
push esi
push 3
call fcn.100546cc
pop ecx
pop ecx
pop esi
mov dword [0x100d231c], 1
leave
ret

Function at 0x1004c0e3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100a3807
call fcn.1007c8b4
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], edi
push 0xf
pop ebx
mov dword [edi], eax
mov eax, 0x1001
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], ebx
mov dword [ebp - 4], ecx
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x40], ecx
mov dword [edi + 0x44], ecx
mov dword [edi + 0x48], ecx
mov dword [edi + 0x4c], ecx
mov dword [edi + 0x50], ecx
mov dword [edi + 0x60], ecx
mov dword [edi + 0x64], ebx
lea esi, [edi + 0x68]
mov byte [ebp - 4], 1
push esi
mov dword [ebp + 0xc], esi
mov dword [esi], ecx
mov dword [esi + 4], ecx
call fcn.1004bb83
pop ecx
mov dword [esi], eax
xor esi, esi
mov dword [edi + 0x70], esi
mov dword [edi + 0x74], esi
mov dword [edi + 0x78], esi
lea ecx, [edi + 0x7c]
mov byte [ebp - 4], 3
call fcn.1000eb50
lea ecx, [edi + 0x12c]
mov byte [ebp - 4], 4
mov dword [edi + 0x128], esi
call fcn.1000eb50
push esi
lea ecx, [edi + 0x1e0]
mov byte [ebp - 4], 5
mov dword [edi + 0x1d8], esi
call fcn.100780e6
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x200], eax
mov dword [edi + 0x210], eax
mov dword [edi + 0x214], ebx
mov byte [edi + 0x200], al
mov dword [edi + 0x218], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x10050a80
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100a3a82
call fcn.1007c8b4
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
xor eax, eax
push 6
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
pop ecx
rep stosd dword es:[edi], eax
mov byte [esi + 0x24], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi], vtable.ATL::CComObject_class_CDocumentEventSinkFTM_.0
mov dword [esi + 4], vtable.ATL::CComObject_class_CDocumentEventSinkFTM_.1.0
mov ecx, dword [0x100d4858]
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10050b7d
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
mov eax, 0x100a3af9
call fcn.1007c8b4
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
xor eax, eax
push 6
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
pop ecx
rep stosd dword es:[edi], eax
mov byte [esi + 0x24], bl
mov dword [esi], vtable.IBrowserEventSink.0
mov dword [ebp - 4], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.10050b1f
push ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 3
call fcn.100780e6
lea eax, [esi + 0x70]
mov dword [esi + 0x68], ebx
mov dword [eax], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], 0xf
mov byte [esi + 0x74], bl
push eax
push 0x100a9134
push ebx
mov byte [ebp - 4], 6
mov byte [esi + 0x98], bl
call fcn.10052f9f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1005870c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100a3ef3
call fcn.1007c8b4
sub esp, 0x22c
and dword [ebp - 4], 0
lea eax, [ebp - 0x238]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x208
push 0
push eax
call fcn.1007f880
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x100587c1
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10057eff
mov edi, 0x100cca6c
pop ecx
pop ecx
cmp eax, edi
je 0x1005877c
mov byte [ebp - 0x15], 0
mov ecx, edi
push dword [ebp - 0x15]
push eax
call fcn.10005e62
lea ecx, [ebp - 0x30]
call fcn.100028b5
cmp dword [0x100cca7c], 0
je 0x100587c1
cmp byte [0x100d2da8], 0
je 0x100587c1
cmp dword [0x100cca80], 0x10
lea ecx, [ebp - 0x11]
cmovae edi, dword [0x100cca6c]
call fcn.10057621
mov esi, eax
mov ecx, esi
call fcn.10022570
push edi
push esi
push 4
call fcn.100546cc
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1005960f
Capabilities:
Get file version info

Disassembly:
push ebp
sub esp, 0x20
mov eax, 0x100a4008
call fcn.1007c8b4
sub esp, 0x64
push ebx
xor ebx, ebx
mov dword [ebp + 0x18], 0xf
push esi
mov dword [ebp + 4], ebx
push edi
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
lea eax, [ebp]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 0x30]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x10059693
mov esi, dword [ebp + 0x2c]
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.100027fc
mov eax, dword [ebp + 0x18]
cmp eax, 0x10
jb 0x10059771
mov ecx, dword [ebp + 4]
inc eax
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x1c], ecx
cmp eax, 0x1000
jb 0x10059768
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.10001c26
mov eax, dword [ebp + 0x20]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
jmp 0x10059768
push 0x100ae7f8
push edi
call fcn.1007ca30
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1005972c
push esi
push edi
push ebx
push dword [ebp + 0x30]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10059725
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], ebx
push eax
lea eax, [ebp + 0x20]
push eax
push 0x100aa024
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10059725
push 0x64
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.1007f880
mov ecx, dword [ebp + 0x20]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [ebp - 0x70]
push 0x63
push eax
call fcn.10056e19
lea ecx, [ebp - 0x70]
add esp, 0x28
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005970f
sub ecx, edx
lea eax, [ebp - 0x70]
push ecx
push eax
lea ecx, [ebp + 4]
call fcn.10002936
push esi
call fcn.1007c98c
pop ecx
mov esi, dword [ebp + 0x2c]
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.100027fc
mov eax, dword [ebp + 0x18]
cmp eax, 0x10
jb 0x10059771
mov ecx, dword [ebp + 4]
inc eax
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x1c], eax
cmp eax, 0x1000
jb 0x10059768
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.10001c26
mov eax, dword [ebp + 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x20]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x24
leave
ret
Function at 0x1005a22b
Capabilities:
Create thread

Disassembly:
mov eax, 0x100a40e4
call fcn.1007c8b4
sub esp, 0x24
push esi
call fcn.10049e5d
test al, al
jne 0x1005a24e
cmp byte [0x100d2fdc], al
je 0x1005a329
call fcn.10049e5d
test al, al
jne 0x1005a2ec
call fcn.100784b1
test al, al
je 0x1005a2ec
call sym.OSMIMHK.DLL_ConfigBrowsers
test al, al
je 0x1005a329
lea ecx, [ebp - 0x30]
call fcn.10035ef3
xor esi, esi
mov dword [ebp - 0x20], 0x1005c9e3
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0x100d2dd8
mov dword [ebp - 0x18], 0x100d2fd8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x30]
call fcn.100364f3
push 0x29c
lea ecx, [ebp - 0x30]
call fcn.100364ff
push esi
push 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
call fcn.1003640d
sub esp, 0x10
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.1003bf8a
push dword [0x100d1580]
call fcn.100438fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
add esp, 0x14
call fcn.10015fd0
jmp 0x1005a329
push 0x100d2cf0
xor esi, esi
push esi
push esi
push 0x1005336e
push esi
push esi
call fcn.10085aee
add esp, 0x18
mov dword [0x100d2cf4], eax
test eax, eax
jne 0x1005a329
push esi
push esi
push esi
push str.Couldnt_start_new_thread
push str.StartBrowserMonitor
push str.OSMIMHK
push 1
call fcn.1004a981
add esp, 0x1c
call fcn.10039741
test eax, eax
jne 0x1005a386
push str.IM_Capture
call fcn.1005abea
mov ecx, eax
call fcn.10070143
test eax, eax
jne 0x1005a362
cmp byte [0x100d2da8], al
je 0x1005a386
lea ecx, [ebp - 0xd]
call fcn.1005723c
mov esi, eax
mov ecx, esi
call fcn.10016340
jmp 0x1005a37c
cmp byte [0x100d2da8], 0
je 0x1005a386
lea ecx, [ebp - 0xd]
call fcn.100577d1
mov esi, eax
mov ecx, esi
call fcn.10027f50
push esi
push 4
call fcn.100546cc
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x1005c3ed
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x100d2da8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
je 0x1005c41c
lea ecx, [ebp + 0xb]
call fcn.10057878
mov esi, eax
mov ecx, esi
call fcn.100553ba
push edi
push esi
push 4
call fcn.100546cc
add esp, 0xc
mov dword [section.Shared], edi
test edi, edi
je 0x1005c453
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x400
mov dword [0x100d6004], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0x100d6008
call fcn.10085700
add esp, 0xc
mov byte [0x100d6407], 0
jmp 0x1005c45a
or dword [0x100d6004], 0xffffffff
jmp 0x1005c46c
nop
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1005d725
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100a2b63
call fcn.1007c8b4
sub esp, 0x14c
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10035ef3
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp + 8]
jne 0x1005d762
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x170]
cmp eax, 0x3e8
jb 0x1005d87d
push esi
push edi
push 0x139
lea eax, [ebp - 0x158]
push 0
push eax
call fcn.1007f880
lea esi, [ebx + 0x10c]
add esp, 0xc
lea edi, [ebp - 0x158]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x147]
sub edx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x1005d794
mov eax, dword [ebx + 0x134]
mov ecx, dword [ebx + 0x154]
mov dword [ebp - 0x43], eax
mov eax, dword [ebx + 0x13c]
mov dword [ebp - 0x3f], eax
mov eax, dword [ebx + 0x150]
mov dword [ebp - 0x3b], eax
mov eax, dword [ebx + 0x158]
mov dword [ebp - 0x33], eax
mov eax, dword [ebx + 0x174]
mov dword [ebp - 0x27], eax
mov eax, dword [ebx + 0x178]
mov dword [ebp - 0x37], ecx
mov ecx, dword [ebx + 0x15c]
mov dword [ebp - 0x23], eax
inc eax
mov dword [ebp - 0x2f], ecx
lea ecx, [ebp - 0x1c]
push 0x539
mov dword [ebx + 0x178], eax
call fcn.100364ff
xor edi, edi
lea eax, [ebp - 0x158]
push edi
push 0x139
push eax
lea ecx, [ebp - 0x1c]
call fcn.1003640d
lea eax, [ebp - 0x1c]
push 0x2710
push eax
call fcn.1003b2ce
mov ecx, eax
call fcn.1005ee31
cmp byte [0x100d2da8], 0
je 0x1005d861
lea ecx, [ebp + 0xf]
call fcn.1005cf14
mov esi, eax
mov ecx, esi
call fcn.10044817
push dword [ebp - 0x2f]
lea eax, [ebp - 0x158]
push dword [ebp - 0x33]
push dword [ebp - 0x37]
push dword [ebp - 0x3b]
push dword [ebp - 0x23]
push eax
push esi
push 3
call fcn.100546cc
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x170], eax
cmp dword [ebx + 0x174], edi
je 0x1005d87b
mov dword [ebx + 0x174], edi
pop edi
pop esi
lea ecx, [ebp - 0x1c]
call fcn.10015fd0
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1005d896
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100a2961
call fcn.1007c8b4
sub esp, 0x10
push ebx
mov ebx, ecx
push edi
lea eax, [ebx + 8]
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.100786c1
mov byte [ebp - 0x10], 1
lea eax, [ebp + 8]
xor edi, edi
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.1003ba5c
cmp eax, dword [ebx]
jne 0x1005d8d1
push 2
pop edi
jmp 0x1005d939
push esi
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1005cca0
mov esi, dword [eax]
mov eax, dword [esi + 0x178]
add esi, 0x18
or eax, dword [esi + 0x164]
jne 0x1005d906
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x160], eax
mov dword [esi + 0x164], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x168], eax
mov eax, dword [ebp + 0xc]
add dword [esi + 0x138], eax
inc dword [esi + 0x13c]
mov dword [esi + 0x16c], edi
cmp dword [esi + 0x120], edi
je 0x1005d938
push edi
push esi
mov ecx, ebx
call fcn.1005d725
pop esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 2
call fcn.100784db
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1005e040
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x100a42a0
call fcn.1007c8b4
sub esp, 0x28
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0xc], 0
je 0x1005e066
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], ebx
mov byte [eax], bl
lea eax, [ebp - 0x10]
push eax
call fcn.1005e186
mov esi, dword [ebp - 0x10]
cmp esi, dword [edi + 4]
je 0x1005e164
cmp byte [esi + 0x18], bl
jne 0x1005e159
push 8
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x34]
push str.Session_
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], bl
call fcn.10002936
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push 0x100a8a24
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], bl
call fcn.1005dbf7
lea ecx, [ebp - 0x1c]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005e0d6
sub ecx, edx
lea eax, [ebp - 0x1c]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.10002784
push 0xc
push 0x100aa4d8
lea ecx, [ebp - 0x34]
call fcn.10002784
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x1005e122
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x18], 1
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x1005e159
mov ecx, dword [ebp - 0x34]
inc eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1005e150
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10001c26
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov al, byte [esi + 0x18]
mov byte [ecx], al
mov ebx, dword [esi + 0x14]
cmp dword [edi + 0xc], 0
je 0x1005e173
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x10066c88
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
push dword [ebp + 8]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov dword [esi], edi
test edi, edi
je 0x10066d08
push ebx
mov ebx, 0x208
lea eax, [ebp - 0x208]
push ebx
push 0
push eax
call fcn.1007f880
add esp, 0xc
lea eax, [ebp - 0x208]
push ebx
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameA
pop ebx
test eax, eax
jne 0x10066ce6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
jmp 0x10066d08
lea ecx, [ebp - 0x208]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10066cef
sub ecx, edx
lea eax, [ebp - 0x208]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.10002936
pop edi
pop esi
leave
ret
Function at 0x100694ba
Capabilities:
Get file version info

Disassembly:
mov eax, 0x100a4a14
call fcn.1007c8b4
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
push eax
push dword [ebp + 8]
movlpd qword [ebp - 0x24], xmm0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x10069613
push 0x100ae7f8
push edi
call fcn.1007ca30
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10069613
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100695ff
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x100aa024
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100695ff
mov eax, dword [ebp - 0x14]
xor edi, edi
mov ebx, dword [eax + 8]
or edi, dword [eax + 0xc]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10069605
cmp dword [ebp - 0x10], 0
je 0x10069605
push 0x64
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1007f880
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xOriginalFilename
lea eax, [ebp - 0x110]
push 0x64
push eax
call fcn.10072ac7
add esp, 0x20
test eax, eax
js 0x10069605
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10069605
push dword [ebp - 0x1c]
lea eax, [ebp - 0xa8]
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xac], eax
call fcn.100384b4
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0xac]
and dword [ebp - 4], 0
call fcn.10002936
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0xac], eax
je 0x10069605
push dword [ebp - 0xac]
call fcn.1008582f
pop ecx
jmp 0x10069605
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push esi
call fcn.1007c98c
pop ecx
mov edx, ebx
mov eax, edi
pop ebx
jmp 0x10069617
xor eax, eax
xor edx, edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret