joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b590
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000b610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000b660
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x1000b6f1
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nST_Scan:
push eax
call fcn.10001100
lea eax, [ebp - 0x174]
push str.Speed_Hack_or_System_Freeze_detected_
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0x174]
call fcn.100032c0
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000b7af
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.ST_Scan:
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.Speed_Hack_or_System_Freeze_detected_
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x2c
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
push 0
cmp eax, 1
jne 0x1000b7e1
push 0
push 0
push 0x1000b5e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000b7f1
push 0
push 0
push 0x1000b5b0
jmp 0x1000b7c4
cmp eax, 3
jne 0x1000b801
push 0
push 0
push 0x10002b20
jmp 0x1000b7c4
cmp eax, 4
jne 0x1000b7db
push 0
push 0
push 0x10015d60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.ST_Scan
push str.Speed_Hack_detected_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000b7d9
Function at 0x1000c9b0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x1000ca4e
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_HB___Load_data_fail:
push eax
call fcn.10001100
lea eax, [ebp - 0x174]
push str.Unable_to_load_data_
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0x174]
call fcn.100032c0
push 2
push 0x100406a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000cb0c
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.HB___Load_data_fail:
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.Unable_to_load_data_
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x2c
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
cmp eax, 1
je 0x1000cb4d
cmp eax, 3
je 0x1000cb4d
cmp eax, 4
je 0x1000cb4d
push 0
cmp eax, 2
jne 0x1000cb47
push 0
push 0
push 0x1000cb60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000cb90
jmp 0x1000cb30
Function at 0x1000cbc0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x1000cc4d
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_HB___FTP_Server_connection_fail_
push eax
call fcn.10001100
add esp, 8
lea ecx, [ebp - 0x174]
call fcn.100032c0
push 2
push 0x100406a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000ccfa
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.HB___FTP_Server_connection_fail_
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x24
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
cmp eax, 1
je 0x1000cd3b
cmp eax, 3
je 0x1000cd3b
cmp eax, 4
je 0x1000cd3b
push 0
cmp eax, 2
jne 0x1000cd35
push 0
push 0
push 0x1000cd50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000cd80
jmp 0x1000cd1e
Function at 0x1000cdb0
Capabilities:
Capture public ip
Connect to http server
Create http request
Read data from internet
Receive data
Send file using ftp
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100525c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetOpenA]
push esi
push edi
push 0
push 0
push 0
push 1
push 0
call ebx
push 0
push 0
push 1
push dword [0x10053730]
push dword [0x1005372c]
push 0x15
push dword [0x10053728]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0
push 0
push 0
push 0
mov edi, eax
call ebx
push 0
push 0x80000000
push 0
push 0
push str.http:__icanhazip.com_
push eax
mov dword [ebp - 0x3c], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x1000cef4
lea eax, [ebp - 0x38]
push eax
push 0x2f
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x38]
cmp eax, 0x2f
jae 0x1000cf27
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp + eax - 0x34], 0
call esi
push 0
push 2
lea eax, [ebp - 0x34]
push eax
push 0x10041b10
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x1000cf15
push edi
call esi
push dword [ebp - 0x3c]
call esi
push 0
push 0
push 0
push 1
push 0
call ebx
push 0
push 0x8000000
push 1
push dword [0x10053730]
mov edi, eax
push dword [0x1005372c]
push 0x15
push dword [0x10053728]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 1
push 0x80
push 1
push 0x10041b0c
mov ebx, eax
push str.1Hardware_Banlist.txt
push ebx
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
je 0x1000cef9
push 2
push 0x10041b0c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call esi
push edi
call esi
call fcn.1000d6e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017143
mov esp, ebp
pop ebp
ret
call fcn.1000cf30
push 0x10041b0c
call fcn.1001df45
push 0x10041b10
call fcn.1001df45
add esp, 8
call fcn.1000cbc0
push 0x10041b10
call fcn.1001df45
add esp, 4
call fcn.1000cbc0
call fcn.10017296
int3
Function at 0x1000cf30
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x1000cfbd
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nHB___HTTP_connection_fail_
push eax
call fcn.10001100
add esp, 8
lea ecx, [ebp - 0x174]
call fcn.100032c0
push 2
push 0x100406a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000d06a
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.HB___HTTP_connection_fail_
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x24
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
cmp eax, 1
je 0x1000d0ab
cmp eax, 3
je 0x1000d0ab
cmp eax, 4
je 0x1000d0ab
push 0
cmp eax, 2
jne 0x1000d0a5
push 0
push 0
push 0x1000d0c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000d0f0
jmp 0x1000d08e
Function at 0x1000d120
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100418e0
call fcn.1001df45
add esp, 4
cmp dword [0x100537bc], 1
jne 0x1000d1cb
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_Hardware_Banned:
push eax
call fcn.10001100
lea eax, [ebp - 0x174]
push str.Contact_The_Creator_
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0x174]
call fcn.100032c0
push 2
push 0x100406a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000d278
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.HB___Hardware_Banned_
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x24
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
cmp eax, 1
je 0x1000d2b9
cmp eax, 3
je 0x1000d2b9
cmp eax, 4
je 0x1000d2b9
push 0
cmp eax, 2
jne 0x1000d2b3
push 0
push 0
push 0x1000c950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000c980
jmp 0x1000d29c
Function at 0x1000d2d0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x14
mov dword [ebp - 4], 4
call fcn.1001e001
push 0x288
mov ebx, eax
call fcn.1001e001
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000d310
push 0x17e
push str.D:CF_DevAnti_CheatCodex_ProtectHardware_Ban.cpp
push str.AdapterInfo___NULL
call fcn.1002317c
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1000d3aa
push dword [ebp - 4]
call fcn.1001e001
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000d34c
push 0x182
push str.D:CF_DevAnti_CheatCodex_ProtectHardware_Ban.cpp
push str.AdapterInfo___NULL
call fcn.1002317c
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1000d399
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X:_02X:_02X:_02X:_02X:_02X
push ebx
call fcn.1000f5e0
add esp, 0x20
push esi
call fcn.1001c0d0
add esp, 4
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1000c9b0
int3

Function at 0x1000d3b0
Capabilities:
Create thread

Disassembly:
push 0x10041b0c
call fcn.1001df45
push 0x10041b10
call fcn.1001df45
push 0x100418e0
call fcn.1001df45
add esp, 0xc
push 0
push 0
push 0
push 0x1000dd40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000ddf0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003eee0
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x100525c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x64
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1000de90
push 1
push 0x40
push 8
push 0x10041b10
lea ecx, [ebp - 0x128]
call fcn.10001830
lea eax, [ebp - 0x128]
mov dword [ebp - 4], 0
push 0x10041b2c
push eax
call fcn.10001100
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0x128]
call fcn.100032c0
call fcn.1000cdb0
lea ecx, [ebp - 0x128]
call fcn.100026a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017143
mov esp, ebp
pop ebp
ret
Function at 0x1000f650
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100537bc], 1
jne 0x1000f6f3
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nAL_Scan:
push eax
call fcn.10001100
add esp, 8
lea eax, [ebp - 0x174]
push str._are_not_running_on_system_
push dword [0x10053738]
push eax
call fcn.10001100
add esp, 8
push eax
call fcn.10001100
add esp, 8
lea ecx, [ebp - 0x174]
call fcn.100032c0
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000f7c3
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str.AL_Scan:
push eax
call fcn.10001100
add esp, 0x1c
lea eax, [ebp - 0xc4]
push str._are_not_running_on_system_
push dword [0x10053738]
push eax
call fcn.10001100
add esp, 8
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
push 0
cmp eax, 1
jne 0x1000f7f5
push 0
push 0
push 0x1000f960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000f805
push 0
push 0
push 0x1000f930
jmp 0x1000f7d8
cmp eax, 3
jne 0x1000f815
push 0
push 0
push 0x10002b20
jmp 0x1000f7d8
cmp eax, 4
jne 0x1000f7ef
push 0
push 0
push 0x10015d60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.AL_Scan
push dword [0x10053738]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000f7ed

Function at 0x1000f910
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000f850
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000f990
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000f9b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000fae0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e47b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
push edi
mov eax, dword [0x100525c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0
push edi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x1000fcd9
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x100537bc], 1
jne 0x1000fba0
push 1
push 0x40
push 8
push str.rez_UI_Scripts_1.s
lea ecx, [ebp - 0x174]
call fcn.10001830
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push 0x10040698
push eax
call fcn.10001100
lea eax, [ebp - 0x174]
push edi
push eax
call fcn.10001100
add esp, 0x10
lea ecx, [ebp - 0x174]
call fcn.100032c0
push 2
push 0x100406a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100026a0
cmp dword [0x100537cc], 1
jne 0x1000fc5a
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcd5
lea eax, [ebp - 0x14]
push eax
call fcn.1001dcae
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100406a4
call fcn.10001830
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.10001100
push esi
call fcn.1001d9c9
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push 0x100406b8
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.10001100
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.10001100
add esp, 0x2c
lea ecx, [ebp - 0xc4]
call fcn.100032c0
push 2
push 0x100406a4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100026a0
mov eax, dword [0x100537c0]
push 0
cmp eax, 1
jne 0x1000fc8c
push 0
push 0
push 0x10002af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000fc9c
push 0
push 0
push 0x1000fcf0
jmp 0x1000fc6f
cmp eax, 3
jne 0x1000fcac
push 0
push 0
push 0x10002b20
jmp 0x1000fc6f
cmp eax, 4
jne 0x1000fc86
push 0
push 0
push 0x10015d60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x10040444
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000fc84
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100106b0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100525c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [0x10053720]
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x200030
push str.CONFIGURATION_MESSAGE
test eax, eax
je 0x100107ed
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_nMain_Window_found__n_nClick_Ok_to_search_Main_Window_Class.
push 0
call edi
push 0
push dword [0x10053718]
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
push 0x200030
push str.CONFIGURATION_MESSAGE
test eax, eax
je 0x100107dc
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_n_Main_Class_Window_found__n_nClick_Ok_to_search_Main_PID.
push 0
call edi
push 0
push 2
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1001079a
nop word [eax + eax]
mov eax, dword [0x100536f0]
lea ecx, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10010780
test dl, dl
je 0x1001077c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10010780
add ecx, 2
add eax, 2
test dl, dl
jne 0x10010760
xor eax, eax
jmp 0x10010785
sbb eax, eax
or eax, 1
test eax, eax
je 0x100107c1
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10010750
cmp esi, 0xffffffff
je 0x100107d4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200030
push str.CONFIGURATION_MESSAGE
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_n_Main_PID_NOT_FOUND__n_nCheck__START.cpp_____carrega.Nome_do_Main__configuration_
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200030
push str.CONFIGURATION_MESSAGE
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_nMain_PID_found__n_nEVERYTHING_OK__n_nTurn_OFF__START.cpp___carrega.Test_Main_Win_Class_PID_
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_n_Main_Class_Window_NOT_FOUND__n_nCheck__START.cpp___carrega.MainClassName__configuration_
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_n_Main_Window_NOT_FOUND__n_nCheck__START.cpp___carrega.MainWindowName__configuration_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]