joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013b10
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f2fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10056050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005b97c], 1
jne 0x10013bcc
sub esp, 0xc
lea ecx, [ebp - 0x174]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nST_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.10005930
mov edx, str.Speed_Hack_or_System_Freeze_detected_
lea ecx, [ebp - 0x174]
call fcn.10005930
lea ecx, [ebp - 0x170]
call fcn.10004900
test eax, eax
jne 0x10013bba
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005b98c], 1
jne 0x10013cad
lea eax, [ebp - 0x14]
push eax
call fcn.10020f8f
lea eax, [ebp - 0x14]
push eax
call fcn.1002127c
push ecx
push 0x1004c450
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc4]
call fcn.10005930
push esi
call fcn.10021ca8
add esp, 4
lea ecx, [ebp - 0xc4]
mov edx, eax
call fcn.10005930
mov edx, str.ST_Scan:
lea ecx, [ebp - 0xc4]
call fcn.10005930
mov edx, str.Speed_Hack_or_System_Freeze_detected_
lea ecx, [ebp - 0xc4]
call fcn.10005930
mov edx, str._n__________________
lea ecx, [ebp - 0xc4]
call fcn.10005930
lea ecx, [ebp - 0xc0]
call fcn.10004900
test eax, eax
jne 0x10013c95
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004c450
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100030f0
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x10013cdf
push 0
push 0
push 0x10013ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10013cef
push 0
push 0
push 0x10013ab0
jmp 0x10013cc2
cmp eax, 3
jne 0x10013cd9
push 0
push 0
push 0x10001f10
jmp 0x10013cc2

Function at 0x10015cf0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push dword [0x1005b8f8]
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10015d1e
push 0
push dword [0x1005b8dc]
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
jne 0x10015d23
jmp fcn.10015ab0
mov esp, ebp
pop ebp
ret
Function at 0x10015dd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x10015e76
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x10015e2b
push 0
push 0
push 0x10015da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10015e3b
push 0
push 0
push 0x10015d70
jmp 0x10015e0e
cmp eax, 3
jne 0x10015e4b
push 0
push 0
push 0x10001f10
jmp 0x10015e0e
push esi
call dword [sym.imp.USER32.dll_FindWindowA]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
push 1
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10015e90
Capabilities:
Create thread
Terminate process

Disassembly:
mov ecx, str.PROCEXPL
call fcn.10015dd0
mov ecx, str.TreeListWindowClass
call fcn.10015dd0
mov ecx, str.ProcessHacker
call fcn.10015dd0
mov ecx, str.PhTreeNew
call fcn.10015dd0
mov ecx, str.RegEdit_RegEdit
call fcn.10015dd0
mov ecx, str.0x150114__1376532_
call fcn.10015dd0
mov ecx, str.SysListView32
call fcn.10015dd0
mov ecx, 0x1005058c
call fcn.10015dd0
mov ecx, str.TformSettings
call fcn.10015dd0
mov ecx, str.Afx:400000:8:10011:0:20575
call fcn.10015dd0
mov ecx, str.TWildProxyMain
call fcn.10015dd0
mov ecx, str.TUserdefinedform
call fcn.10015dd0
mov ecx, str.TformAddressChange
call fcn.10015dd0
mov ecx, str.TMemoryBrowser
call fcn.10015dd0
mov ecx, str.TFoundCodeDialog
call fcn.10015dd0
mov ecx, str.WindowsForms10.Window.8.app.0.378734a
call fcn.10015dd0
mov ecx, str.WindowsForms10.Window.8.app.0.2bf8098_r15_ad1
call fcn.10015dd0
mov ecx, str.WindowsForms10.Window.8.app.0.3b95145_r14_ad1
call fcn.10015dd0
mov ecx, str.ThunderRT6FormDC
call fcn.10015dd0
mov ecx, str.AutoIt_v3_GUI
call fcn.10015dd0
mov ecx, str.TFormMain.UnicodeClass
call fcn.10015dd0
mov ecx, str.WindowsForms10.Window.8.app.0.141b42a_r14_ad1
call fcn.10015dd0
mov ecx, str.Window
call fcn.10015dd0
mov ecx, str.Hile
call fcn.10015dd0
mov ecx, str.TMessageForm
call fcn.10015dd0
mov ecx, str.Somethin
call fcn.10015dd0
mov ecx, str.Dll_Injector
call fcn.10015dd0
mov ecx, str.Form
call fcn.10015dd0
mov ecx, str.TForm
call fcn.10015dd0
mov ecx, str.TForm1
call fcn.10015dd0
mov ecx, str.TForm2
call fcn.10015dd0
mov ecx, str.TForm3
call fcn.10015dd0
mov ecx, str.TForm4
call fcn.10015dd0
mov ecx, str.WindowsForms10.Window.8.app.0.141b42a_r9_ad1
call fcn.10015dd0
mov ecx, str.TBaseForm
call fcn.10015dd0
mov ecx, str.giKaXXD_p
call fcn.10015dd0
mov ecx, str.TMainForm
call fcn.10015dd0
mov ecx, str.ConsoleWindowClass
call fcn.10015dd0
mov ecx, str.TMemoryBreak_Login
call fcn.10015dd0
mov ecx, str.TMemoryBreak_Base
call fcn.10015dd0
mov ecx, str.TMemoryBreak_Iris
call fcn.10015dd0
mov ecx, str.TMemoryBreak_M24Pro
call fcn.10015dd0
mov ecx, str.TMemoryBreak_PServer
call fcn.10015dd0
mov ecx, str.TMemoryBreak_EzGlobal
call fcn.10015dd0
mov ecx, str.Tmain_form
call fcn.10015dd0
mov ecx, str.coYLbq6s9
call fcn.10015dd0
mov ecx, str.giKaXXD_
call fcn.10015dd0
mov ecx, str.WdcWindow
call fcn.10015dd0
mov ecx, str.ProcessHacker
call fcn.10015dd0
mov ecx, str.AutoIt_v3_GUI
call fcn.10015dd0
mov ecx, str.giKaXXD_p
call fcn.10015dd0
mov ecx, str._M24_Pro_
call fcn.10015dd0
mov ecx, str.TM24Pro_
call fcn.10015dd0
mov ecx, str.TPvPBot_
call fcn.10015dd0
mov ecx, str.Ghost
call fcn.10015dd0
mov ecx, 0x1005089c
call fcn.10015dd0
mov ecx, str.msctls_progress32
call fcn.10015dd0
mov ecx, str.PhTreeNew
call fcn.10015dd0
mov ecx, str.Somethin
call fcn.10015dd0
mov ecx, str.TMemo
call fcn.10015dd0
mov ecx, str.WindowsForms10.Window.8.app.0.141b42a_r6_ad1
call fcn.10015dd0
mov ecx, str.TSimhiHackMiniForm
call fcn.10015dd0
mov ecx, str.W7nd0w
call fcn.10015dd0
mov ecx, 0x1004bdd8
jmp fcn.10015dd0
Function at 0x10016b80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x10056050]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push dword [0x1005b8e0]
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x200030
push str.CONFIGURATION_MESSAGE
test eax, eax
je 0x10016cb8
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_nMain_Window_found__n_nClick_Ok_to_search_Main_Window_Class.
push 0
call edi
push 0
push dword [0x1005b8d8]
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
push 0x200030
push str.CONFIGURATION_MESSAGE
test eax, eax
je 0x10016ca7
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_n_Main_Class_Window_found__n_nClick_Ok_to_search_Main_PID.
push 0
call edi
push 0
push 2
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10016c65
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
mov eax, dword [0x1005b8b0]
lea ecx, [esp + 0x34]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10016c50
test dl, dl
je 0x10016c4c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10016c50
add ecx, 2
add eax, 2
test dl, dl
jne 0x10016c30
xor eax, eax
jmp 0x10016c55
sbb eax, eax
or eax, 1
test eax, eax
je 0x10016c8c
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x10016c23
cmp esi, 0xffffffff
je 0x10016c9f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200030
push str.CONFIGURATION_MESSAGE
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_n_Main_PID_NOT_FOUND__n_nCheck__START.cpp_____carrega.Nome_do_Main__configuration_
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200030
push str.CONFIGURATION_MESSAGE
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_nMain_PID_found__n_nEVERYTHING_OK__n_nTurn_OFF__START.cpp___carrega.Test_Main_Win_Class_PID_
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_n_Main_Class_Window_NOT_FOUND__n_nCheck__START.cpp___carrega.MainClassName__configuration_
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.WARNING___START.cpp___Test_Main_Win_Class_PID__Turned_ON__n_n_Main_Window_NOT_FOUND__n_nCheck__START.cpp___carrega.MainWindowName__configuration_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10016d10
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f51b
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x10056050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x1005b8b0]
lea eax, [ebp - 0x34]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x10016f4a
cmp dword [0x1005b97c], 1
jne 0x10016de8
sub esp, 0xc
lea ecx, [ebp - 0x1a0]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____File_not_found:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1a0]
call fcn.10005930
mov edx, edi
lea ecx, [ebp - 0x1a0]
call fcn.10005930
lea ecx, [ebp - 0x19c]
call fcn.10004900
test eax, eax
jne 0x10016dd6
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005b98c], 1
jne 0x10016ecb
lea eax, [ebp - 0x40]
push eax
call fcn.10020f8f
add esp, 4
lea eax, [ebp - 0x40]
push eax
call fcn.1002127c
sub esp, 8
lea ecx, [ebp - 0xf0]
mov esi, eax
push 0x1004c450
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xf0]
call fcn.10005930
push esi
call fcn.10021ca8
add esp, 4
lea ecx, [ebp - 0xf0]
mov edx, eax
call fcn.10005930
mov edx, str.FN_Scan:____File_not_found:
lea ecx, [ebp - 0xf0]
call fcn.10005930
mov edx, edi
lea ecx, [ebp - 0xf0]
call fcn.10005930
mov edx, str._n__________________
lea ecx, [ebp - 0xf0]
call fcn.10005930
lea ecx, [ebp - 0xec]
call fcn.10004900
test eax, eax
jne 0x10016eb3
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004c450
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xf0]
call fcn.100030f0
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x10016efd
push 0
push 0
push 0x10016cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10016f0d
push 0
push 0
push 0x10016cf0
jmp 0x10016ee0
cmp eax, 3
jne 0x10016f1d
push 0
push 0
push 0x10001f10
jmp 0x10016ee0
cmp eax, 4
jne 0x10016ef7
push 0
push 0
push 0x1001a230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10016ef5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b845
mov esp, ebp
pop ebp
ret
Function at 0x10016f70
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f51b
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x10056050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x1005b8d4]
lea eax, [ebp - 0x34]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x100171aa
cmp dword [0x1005b97c], 1
jne 0x10017048
sub esp, 0xc
lea ecx, [ebp - 0x1a0]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____File_not_found:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1a0]
call fcn.10005930
mov edx, edi
lea ecx, [ebp - 0x1a0]
call fcn.10005930
lea ecx, [ebp - 0x19c]
call fcn.10004900
test eax, eax
jne 0x10017036
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005b98c], 1
jne 0x1001712b
lea eax, [ebp - 0x40]
push eax
call fcn.10020f8f
add esp, 4
lea eax, [ebp - 0x40]
push eax
call fcn.1002127c
sub esp, 8
lea ecx, [ebp - 0xf0]
mov esi, eax
push 0x1004c450
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xf0]
call fcn.10005930
push esi
call fcn.10021ca8
add esp, 4
lea ecx, [ebp - 0xf0]
mov edx, eax
call fcn.10005930
mov edx, str.FN_Scan:____File_not_found:
lea ecx, [ebp - 0xf0]
call fcn.10005930
mov edx, edi
lea ecx, [ebp - 0xf0]
call fcn.10005930
mov edx, str._n__________________
lea ecx, [ebp - 0xf0]
call fcn.10005930
lea ecx, [ebp - 0xec]
call fcn.10004900
test eax, eax
jne 0x10017113
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004c450
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xf0]
call fcn.100030f0
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x1001715d
push 0
push 0
push 0x10016cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1001716d
push 0
push 0
push 0x10016cf0
jmp 0x10017140
cmp eax, 3
jne 0x1001717d
push 0
push 0
push 0x10001f10
jmp 0x10017140
cmp eax, 4
jne 0x10017157
push 0
push 0
push 0x1001a230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10017155
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b845
mov esp, ebp
pop ebp
ret
Function at 0x100171d0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e73b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10056050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005b97c], 1
jne 0x1001728d
sub esp, 0xc
lea ecx, [ebp - 0x178]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____Thats_not_my_name__My_name_is:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10005930
mov edx, dword [0x1005b8b0]
lea ecx, [ebp - 0x178]
call fcn.10005930
lea ecx, [ebp - 0x174]
call fcn.10004900
test eax, eax
jne 0x1001727b
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005b98c], 1
jne 0x10017374
lea eax, [ebp - 0x18]
push eax
call fcn.10020f8f
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1002127c
sub esp, 8
lea ecx, [ebp - 0xc8]
mov esi, eax
push 0x1004c450
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10005930
push esi
call fcn.10021ca8
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10005930
mov edx, str.FN_Scan:____Thats_not_my_name__My_name_is:
lea ecx, [ebp - 0xc8]
call fcn.10005930
mov edx, dword [0x1005b8b0]
lea ecx, [ebp - 0xc8]
call fcn.10005930
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10005930
lea ecx, [ebp - 0xc4]
call fcn.10004900
test eax, eax
jne 0x1001735c
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004c450
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.100030f0
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x100173a6
push 0
push 0
push 0x10016cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x100173b6
push 0
push 0
push 0x10016cf0
jmp 0x10017389
cmp eax, 3
jne 0x100173c6
push 0
push 0
push 0x10001f10
jmp 0x10017389
cmp eax, 4
jne 0x100173a0
push 0
push 0
push 0x1001a230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push dword [0x1005b8b0]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001739e
Function at 0x10017400
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e73b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10056050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005b97c], 1
jne 0x100174bd
sub esp, 0xc
lea ecx, [ebp - 0x178]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____Thats_not_my_name__My_name_is:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10005930
mov edx, dword [0x1005b8e4]
lea ecx, [ebp - 0x178]
call fcn.10005930
lea ecx, [ebp - 0x174]
call fcn.10004900
test eax, eax
jne 0x100174ab
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005b98c], 1
jne 0x100175a4
lea eax, [ebp - 0x18]
push eax
call fcn.10020f8f
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1002127c
sub esp, 8
lea ecx, [ebp - 0xc8]
mov esi, eax
push 0x1004c450
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10005930
push esi
call fcn.10021ca8
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10005930
mov edx, str.FN_Scan:____Thats_not_my_name__My_name_is:
lea ecx, [ebp - 0xc8]
call fcn.10005930
mov edx, dword [0x1005b8e4]
lea ecx, [ebp - 0xc8]
call fcn.10005930
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10005930
lea ecx, [ebp - 0xc4]
call fcn.10004900
test eax, eax
jne 0x1001758c
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004c450
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.100030f0
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x100175d6
push 0
push 0
push 0x10016cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x100175e6
push 0
push 0
push 0x10016cf0
jmp 0x100175b9
cmp eax, 3
jne 0x100175f6
push 0
push 0
push 0x10001f10
jmp 0x100175b9
cmp eax, 4
jne 0x100175d0
push 0
push 0
push 0x1001a230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push dword [0x1005b8e4]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x100175ce
Function at 0x10017670
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e73b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10056050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005b97c], 1
jne 0x1001772d
sub esp, 0xc
lea ecx, [ebp - 0x178]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____Thats_not_my_window_Name__My_window_name_is:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10005930
mov edx, dword [0x1005b8e0]
lea ecx, [ebp - 0x178]
call fcn.10005930
lea ecx, [ebp - 0x174]
call fcn.10004900
test eax, eax
jne 0x1001771b
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005b98c], 1
jne 0x10017814
lea eax, [ebp - 0x18]
push eax
call fcn.10020f8f
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1002127c
sub esp, 8
lea ecx, [ebp - 0xc8]
mov esi, eax
push 0x1004c450
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10005930
push esi
call fcn.10021ca8
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10005930
mov edx, str.FN_Scan:____Thats_not_my_Window_name__My_Window_Name_is:
lea ecx, [ebp - 0xc8]
call fcn.10005930
mov edx, dword [0x1005b8e0]
lea ecx, [ebp - 0xc8]
call fcn.10005930
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10005930
lea ecx, [ebp - 0xc4]
call fcn.10004900
test eax, eax
jne 0x100177fc
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004c450
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.100030f0
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x10017846
push 0
push 0
push 0x10017630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10017856
push 0
push 0
push 0x10017650
jmp 0x10017829
cmp eax, 3
jne 0x10017866
push 0
push 0
push 0x10001f10
jmp 0x10017829
cmp eax, 4
jne 0x10017840
push 0
push 0
push 0x1001a230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push dword [0x1005b8e0]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001783e