joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a55c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x240c8]
test esi, esi
je 0x10a5608
mov eax, dword [esi + 4]
push 0
push 0
push 0
push 0
push esi
push eax
call fcn.0109e890
mov esi, dword [esi]
mov eax, dword [esi + 0x2b438]
test eax, eax
je 0x10a5608
cmp eax, 0xffffffff
je 0x10a5608
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 0x2b438], 0
mov ecx, dword [edi + 8]
mov esi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push 0
push 0x104d9c0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10a5631
push eax
mov eax, dword [esi + 0x1bc]
call eax
push edi
call fcn.0104e9d0
push edi
call fcn.010a5550
mov ecx, dword [edi + 0x240c8]
push ecx
call fcn.0109ef20
pop edi
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x10a56d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, dword [ebp + 8]
push 0x101233c
push esi
mov dword [ebp - 4], eax
call fcn.01095e70
mov eax, dword [esi]
push 0x1388
push 0x101233c
push eax
call fcn.0108a720
test eax, eax
je 0x10a570d
mov eax, 1
jmp 0x10a572a
push 0x101233c
push esi
call fcn.01095e70
mov ecx, dword [esi]
push 0x1388
push 0x101233c
push ecx
call fcn.0108a720
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
mov edi, eax
test eax, eax
jne 0x10a574a
push 0x7d0
call ebx
push 0x101233c
push esi
call fcn.0109e330
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0xbb8
jbe 0x10a5761
push 0x7d0
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10a60b0
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x2834c]
mov ecx, dword [eax + 0x43c]
cmp dword [ecx + 0x10], 0
jne 0x10a622d
mov edx, dword [edi + 8]
mov eax, dword [edx]
push ebx
push esi
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x101306c
push 0x1013038
push DirectSoundEnumerateW
push eax
call fcn.010895a0
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov esi, eax
test esi, esi
jne 0x10a6192
push 0x106
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10a622b
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [edi + 8]
mov edx, dword [ecx]
add edx, 0x26838
push edx
push 0x1012ff0
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.0101e760
add esp, 0x1c
lea ecx, [ebp - 0x210]
push ecx
push 0x103
push esi
push 0x100c504
push 0x101306c
push 0x1012fdc
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
jne 0x10a6192
push esi
call fcn.010608a0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.0101e3c0
xor ecx, ecx
test eax, eax
jbe 0x10a61ae
mov edi, edi
mov edx, 0xffe3
add word [esi + ecx*2], dx
inc ecx
cmp ecx, eax
jb 0x10a61a0
test esi, esi
jne 0x10a61b6
xor eax, eax
jmp 0x10a61cd
cmp word [esi], 0
mov eax, esi
je 0x10a61c9
mov edi, edi
add eax, 2
cmp word [eax], 0
jne 0x10a61c0
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.0101de80
mov ecx, dword [edi + 0x2834c]
mov edx, dword [ecx + 0x43c]
mov dword [edx + 0x10], eax
mov eax, dword [edi + 0x2834c]
mov ecx, dword [eax + 0x43c]
cmp dword [ecx + 0x10], 0
je 0x10a621b
mov edx, eax
mov eax, dword [edx + 0x43c]
mov ecx, dword [eax + 0x10]
lea eax, [edi + 0x2b43c]
test eax, eax
je 0x10a621b
test ecx, ecx
je 0x10a621b
push 0x3f
push ecx
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
test esi, esi
je 0x10a622b
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10a6300
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jne 0x10a6312
xor eax, eax
jmp 0x10a632c
mov eax, ecx
cmp word [ecx], dx
je 0x10a6328
lea esp, [esp]
add eax, 2
cmp word [eax], dx
jne 0x10a6320
sub eax, ecx
sar eax, 1
push esi
mov esi, dword [ebp + 0x10]
add eax, eax
push eax
push ecx
push esi
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0108b9a0
push esi
call fcn.0108ba70
pop esi
pop ebp
ret 0xc
Function at 0x10ae4d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x2a10c], 0x1c
test eax, eax
je 0x10ae50d
push eax
call fcn.0109ef20
cmp dword [esi + 0x2a020], 0
je 0x10ae50d
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xa
call edi
cmp dword [esi + 0x2a020], 0
jne 0x10ae500
push 0
lea eax, [esi + 0x2a1a0]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push esi
push fcn.0110a880
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10ae544
push eax
mov eax, dword [edi + 0x1bc]
call eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x10b1540
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x1000
call fcn.0101c4b0
mov esi, dword [ebp + 8]
lea ebx, [esi + eax*4 + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x1000
push esi
call fcn.01087c30
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10b1450
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10b1592
mov ecx, dword [esi + 0x1bc]
push eax
call ecx
mov edx, dword [esi + 0x130]
call edx
push eax
push esi
call fcn.010885e0
mov edi, eax
test edi, edi
je 0x10b15c3
push 1
push 0x100fc70
push edi
push esi
call fcn.01088660
push edi
push esi
call fcn.01088510
push edi
push esi
call fcn.0101cb00
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 0x348]
neg eax
sbb eax, eax
add eax, 2
neg ecx
sbb ecx, ecx
and ecx, 4
push 0
or eax, ecx
push eax
call edx
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10b19c0
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push ebx
mov dword [ebp - 4], edi
call fcn.0108b8e0
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x10b1b98
push 0x82
lea eax, [ebp - 0x8c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0x18], edi
mov edi, dword [ebp + 0xc]
je 0x10b1a8d
push edi
push 0x10144f4
push 0x3f
lea ecx, [ebp - 0x8c]
push ecx
call fcn.0101e760
add esp, 0x10
push 0xa
lea edx, [ebp - 0x8c]
push edx
push edi
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0xc
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x8c]
push eax
push 0x10144f0
push ecx
call fcn.01061570
mov edi, eax
test edi, edi
je 0x10b1b69
mov edx, dword [ebx + 0x4ec]
push edi
push 1
push esi
call edx
mov esi, eax
mov eax, dword [ebx + 0x318]
call eax
test eax, eax
je 0x10b1b44
test esi, esi
je 0x10b1a81
mov ecx, dword [ebx + 0x1bc]
push esi
call ecx
xor esi, esi
mov dword [ebp - 4], 0
jmp 0x10b1b4b
cmp dword [ebx + 0x26a8c], 6
jb 0x10b1aaa
push edi
push 0x10144e0
push 0x3f
lea edx, [ebp - 0x8c]
push edx
jmp 0x10b1a1a
push 0x20a
lea eax, [ebp - 0x298]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x1c]
add esp, 0xc
mov dword [ebp + 8], 0x103
test eax, eax
je 0x10b1ae2
push 0x103
push eax
lea ecx, [ebp - 0x298]
push ecx
call fcn.0101e300
jmp 0x10b1af3
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x298]
push ecx
call fcn.0101e3c0
test eax, eax
je 0x10b1a22
cmp dword [ebp + 0x20], 0
jne 0x10b1b22
push 0x1012aec
lea edx, [ebp - 0x298]
push edx
call fcn.0101e0c0
test eax, eax
je 0x10b1b69
lea eax, [ebp - 0x298]
push eax
push 0x10144d0
lea ecx, [ebp - 0x8c]
push 0x3f
push ecx
call fcn.0101e760
add esp, 0x10
jmp 0x10b1a35
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0
mov dword [edx], esi
call ebx
mov edi, dword [sym.imp.KERNEL32.DLL_HeapFree]
push eax
call edi
mov esi, dword [ebp - 8]
jmp 0x10b1b75
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi + 4]
test eax, eax
je 0x10b1b84
push eax
push 0
call ebx
push eax
call edi
push esi
push 0
call ebx
push eax
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10b23b0
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c8
xor eax, eax
push ebx
push esi
push edi
push 0x105
push eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x1c8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x29c]
mov edi, eax
mov dword [ebp - 0x1c], edi
call ecx
lea edx, [ebp - 0x24]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x50c]
push edx
call eax
mov edx, dword [esi + 0x510]
lea ecx, [ebp - 0x18]
push ecx
call edx
mov ecx, dword [esi + 0x2e8]
lea eax, [ebp - 0x58]
push eax
call ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
mov ecx, dword [ebp - 0x20]
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
test ecx, ecx
jne 0x10b2455
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push edx
mov edx, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [ebp - 0x24]
push ecx
push edx
push edi
push ebx
push 0x1014518
lea eax, [ebp - 0x1c8]
push 0x103
push eax
call fcn.0101d440
lea eax, [ebp - 0x1c8]
add esp, 0x38
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10b2494
xor ecx, ecx
sub eax, esi
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
push eax
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0xc0]
push edx
mov dword [ebp - 0xc0], 0x67452301
mov dword [ebp - 0xbc], 0xefcdab89
mov dword [ebp - 0xb8], 0x98badcfe
mov dword [ebp - 0xb4], 0x10325476
call fcn.0108b9a0
lea eax, [ebp - 0xc0]
push eax
call fcn.0108ba70
lea ecx, [ebp - 0x48]
push ecx
push 0x10
lea edx, [ebp - 0x68]
push edx
call fcn.0101ddb0
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x68]
mov ecx, dword [ebp - 8]
push 0
push 0xffffff
push eax
mov esi, edi
xor esi, dword [ebp - 0x18]
push ecx
call fcn.01121910
movzx edx, word [ebp - 0x52]
mov ecx, dword [ebp - 0x64]
xor ecx, dword [ebp - 4]
xor eax, edx
xor eax, dword [ebp - 0x10]
xor edi, dword [ebp - 8]
xor eax, dword [ebp - 0xc]
lea edx, [ebp - 0x48]
xor eax, dword [ebp - 0x1c]
xor eax, ebx
push eax
mov eax, esi
xor eax, dword [ebp - 0x14]
xor esi, ebx
xor eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push esi
push ecx
mov ecx, dword [ebp + 0xc]
push edi
push edx
push 0x1014504
dec eax
push eax
push ecx
call fcn.0101d440
add esp, 0x24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10b2f90
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10b2f50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x26b60], eax
test eax, eax
je 0x10b2fda
mov ecx, dword [esi + 0x248]
push 0x1388
push eax
call ecx
mov eax, dword [esi + 0x26b60]
test eax, eax
je 0x10b2fda
mov edx, dword [esi + 0x1bc]
push eax
call edx
mov dword [esi + 0x26b60], 0
pop esi
pop ebp
ret 4

Function at 0x10b73e0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10b7466
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x10b7360
push 0
push 0
mov dword [esi], edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10b7438
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x1bc]
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
mov ecx, dword [edi]
shr eax, 2
cmp eax, 0x8000
jae 0x10b7459
push 0
lea edx, [ecx + eax*4 + 0x5a8]
mov eax, dword [ecx]
push edx
push eax
call fcn.010b6e40
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10bb410
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x10151b4
push esi
call fcn.0109d160
test eax, eax
je 0x10bb459
mov eax, dword [esi]
mov ecx, dword [eax + 0x23110]
mov dword [ecx + 0xe38], 0
mov edx, dword [esi]
mov eax, dword [edx + 0x23110]
push 0
push 0x10151b4
push esi
mov dword [eax + 0xe48], 0
call fcn.0109d1e0
mov ecx, dword [esi]
push 0x10151b0
push 0x10100f0
push DirectSoundEnumerateW
push ecx
call fcn.01089830
test eax, eax
je 0x10bb4c1
mov eax, dword [esi]
push edi
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x10151b0
push 0x10100f0
push DirectSoundEnumerateW
push eax
mov dword [ebp + 8], 0
call fcn.01089280
mov edi, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x1037a20
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10bb4c0
mov edx, dword [edi + 0x1bc]
push eax
call edx
pop edi
mov eax, dword [esi]
push eax
call fcn.010b61c0
pop esi
pop ebp
ret 4
Function at 0x10bbdb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
push eax
call fcn.01031820
mov ecx, dword [esi]
mov eax, 1
mov dword [ecx + 0x2f1a4], eax
mov edx, dword [esi]
push eax
mov dword [edx + 0x2f1b0], eax
mov eax, dword [esi]
add eax, 0x2f1ac
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push esi
call fcn.01037a30
push esi
call fcn.010362f0
mov edi, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x106f260
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10bbe17
mov edx, dword [edi + 0x1bc]
push eax
call edx
mov esi, dword [esi]
mov eax, dword [esi + 0x23110]
cmp dword [eax + 0xe38], 0
je 0x10bbe3c
push 0
push 0x101f290
push 0x22
push 0x1004534
push esi
call fcn.010b1940
pop edi
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x10bc3d0
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
jne 0x10bc3ed
xor eax, eax
jmp 0x10bc400
mov eax, esi
cmp word [esi], bx
je 0x10bc3fc
add eax, 2
cmp word [eax], bx
jne 0x10bc3f4
sub eax, esi
sar eax, 1
push eax
push 0x5c
push esi
call fcn.0101e630
test eax, eax
je 0x10bc560
sub eax, esi
push edi
sar eax, 1
push eax
push esi
call fcn.0101e7a0
mov edi, eax
test edi, edi
je 0x10bc555
push 0x20a
lea eax, [ebp - 0x254]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add esp, 0xc
push 0x3f
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.010b23b0
lea ecx, [ebp - 0x48]
push ecx
push edi
push 0x100e444
lea edx, [ebp - 0x254]
push 0x103
push edx
call fcn.0101e760
mov ebx, dword [sym.imp.KERNEL32.DLL_MoveFileW]
add esp, 0x14
lea eax, [ebp - 0x254]
push eax
push esi
call ebx
test eax, eax
jne 0x10bc493
mov edx, dword [ebp + 8]
mov eax, dword [edx]
lea ecx, [ebp - 0x254]
push ecx
push esi
push eax
call fcn.01068c10
push 0x20a
lea ecx, [ebp - 0x460]
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
call fcn.01061120
lea eax, [ebp - 0x48]
push eax
push edi
push 0x100e444
lea ecx, [ebp - 0x460]
push 0x103
push ecx
call fcn.0101e760
add esp, 0x14
lea edx, [ebp - 0x460]
push edx
lea eax, [ebp - 0x254]
push eax
call ebx
test eax, eax
jne 0x10bc4fd
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x460]
push ecx
mov ecx, dword [eax]
lea edx, [ebp - 0x254]
push edx
push ecx
call fcn.01068c10
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea edx, [ebp - 0x460]
push edx
call ebx
test eax, eax
je 0x10bc517
mov dword [ebp - 4], 1
lea eax, [ebp - 0x254]
push eax
call ebx
test eax, eax
je 0x10bc52b
mov dword [ebp - 4], 1
push esi
call ebx
test eax, eax
je 0x10bc539
mov dword [ebp - 4], 1
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10bcb70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ecx, dword [eax + 0x23110]
test ecx, ecx
je 0x10bcbe4
test dword [ecx + 0x138], 0x200
jne 0x10bcb9a
cmp dword [edi + 0x9a8], 0
je 0x10bcbe4
push esi
add eax, 0x2f1b8
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov esi, dword [edi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10b32f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10bcbd4
mov ecx, dword [esi + 0x1bc]
push eax
call ecx
pop esi
xor eax, eax
pop edi
pop ebp
ret 4
mov edx, dword [edi]
add edx, 0x2f1b8
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop esi
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x10bcff0
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x84
push ebx
push esi
push edi
push eax
call fcn.0104da40
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push ecx
mov ebx, eax
push ebx
push edi
call fcn.010bcf90
mov esi, eax
test esi, esi
jne 0x10bd06c
cmp dword [edi + 0x9a8], eax
je 0x10bd06c
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0x84]
push eax
mov dword [ebp + 0xc], 0x3f
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x84]
push 0x1012aec
push ecx
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x10bd06a
test bl, 6
je 0x10bd06a
push edi
call fcn.010ba550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10bd9a0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x108
cmp eax, 0x800c
je 0x10bd9c0
cmp eax, 0x8005
jne 0x10bda45
push 0x105
lea eax, [ebp - 0x108]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0xc]
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x108]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10bda45
push 8
lea eax, [ebp - 0x108]
push 0x10152e0
push eax
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x10bda45
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x298]
push edi
call eax
mov edi, eax
mov ecx, edi
sub ecx, dword [esi + 0x2a07c]
cmp ecx, 0x3a98
jbe 0x10bda43
lea edx, [ebp - 0x100]
push edx
push esi
call fcn.010bd940
mov dword [esi + 0x2a07c], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10bf0e0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
lea eax, [edi + 0x2a098]
push eax
call ebx
cmp dword [edi + 0x2a0a4], 0
jne 0x10bf1bd
cmp dword [edi + 0x2a0a8], 0
jne 0x10bf1bd
mov ecx, dword [edi + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x26b44], 0
jne 0x10bf1bd
push esi
push edi
call fcn.010500b0
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffffc
add esi, 0x226408
cmp dword [edi + 0x2841c], 0xb
je 0x10bf1c2
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x82
lea ecx, [ebp - 0x84]
and eax, 0xffff
push 0
push ecx
mov dword [ebp + 0xc], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
push 0x3f
lea edx, [ebp - 0x84]
push edx
push 0x1004
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
push 0x101535c
lea ecx, [ebp - 0x84]
push ecx
call fcn.0101e0c0
test eax, eax
je 0x10bf1c2
push 1
lea eax, [edi + 0x2a0a4]
push eax
call ebx
mov edx, dword [edi + 8]
push 1
add edx, 0x1640
push edx
call ebx
mov esi, 0x226408
push esi
push edi
call fcn.010bf000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10c0860
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10bbff0
push 0
push 0
mov dword [esi + 0x9c], 2
mov dword [esi + 0x94], 0x1b58
mov dword [esi + 0x98], 0x1388
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [esi]
push esi
add ecx, 0x240d8
push ecx
mov dword [esi + 0xac], eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop esi
pop ebp
ret 4

Function at 0x10c0e30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 8], 0x11
push 0
push 0xd
jne 0x10c0e65
mov edx, dword [ecx + 0xe3c]
push edx
push esi
call fcn.01052b60
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xe38]
push edx
jmp 0x10c0e79
mov edx, dword [ecx + 0xc8c]
push edx
push esi
call fcn.01052b60
lea eax, [edi + 0x812]
push eax
add edi, 0x10
push edi
push esi
call fcn.010c0a00
mov ecx, dword [esi + 8]
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, dword [esi + 8]
or eax, 0x80
push eax
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x65
push 0x193
mov edi, 1
push esi
mov dword [esi + 0xa0], edi
call fcn.01050d80
mov eax, dword [esi]
test dword [eax + 0x28788], 0x2000
je 0x10c0efd
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x10bbff0
push 0
push 0
mov dword [esi + 0x9c], edi
mov dword [esi + 0x94], 0x3a98
mov dword [esi + 0x98], 0x2710
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0xac], eax
pop edi
pop esi
pop ebp
ret 8