joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018190
Capabilities:
Print debug messages
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x100181c5
push 0x20
mov eax, dword [ebp + 0xc]
push eax
push 0x100500bc
call fcn.10019f50
add esp, 0xc
cmp dword [ebp + 8], 0
jl 0x100181d1
cmp dword [ebp + 8], 3
jle 0x100181d9
or eax, 0xffffffff
jmp 0x10018393
mov ecx, dword [ebp + 8]
mov dword [0x100500dc], ecx
push 0x104
push 0
lea edx, [ebp - 0x110]
push edx
call fcn.10019d20
add esp, 0xc
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.qbot_dll_main
push 0x100500bc
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10018254
mov ecx, dword [ebp - 0x21c]
push ecx
push 0x5c
lea edx, [ebp - 0x110]
push edx
call fcn.100189f0
add esp, 8
push eax
push str.dbg__s__u_qbotdll.txt
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.10019db0
add esp, 0x14
jmp 0x10018286
mov ecx, dword [ebp - 0x21c]
push ecx
push 0x5c
lea edx, [ebp - 0x110]
push edx
call fcn.100189f0
add esp, 8
push eax
push str.dbg__s__u.txt
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.10019db0
add esp, 0x14
push 0x104
push str.c:_tmp_dbg_
push 0x1004ffb8
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x100347ec
push 0x1004ffb8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x218]
push ecx
push 0x1004ffb8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.10024360
add esp, 4
movsx edx, al
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 1
ja 0x1001834a
push 0
lea eax, [ebp - 0x218]
push eax
push 0x100347ec
push str.c:_tmp_dbg_
call fcn.10019010
add esp, 0x10
mov dword [ebp - 0x220], eax
push str.file_test_n
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
test eax, eax
setl cl
push ecx
push 0x1003ce9c
mov edx, dword [ebp - 0x220]
push edx
call fcn.10017fe0
add esp, 0xc
test eax, eax
je 0x10018339
push 0x103
push str.c:_tmp_dbg_
push 0x1003ce94
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0xffffffffffffffff
lea eax, [ebp - 0x220]
push eax
call fcn.10019b10
add esp, 8
cmp dword [ebp - 4], 1
ja 0x10018384
push str.szLogFile
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1004ffb8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.test_from_low_n
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.test_from_low_n
push 0x1004ffb8
call fcn.10017fe0
add esp, 0xc
push str.logger_init__:_ok.
call fcn.10018570
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10018640
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
cmp dword [0x100500dc], 3
jl 0x100186ef
mov al, byte [0x10033426]
mov byte [ebp - 0x408], al
push 0x3ff
push 0
lea ecx, [ebp - 0x407]
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x100500bc
push str._s:
push 0x3ff
lea edx, [ebp - 0x408]
push edx
call fcn.10019db0
add esp, 0x10
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x40c], eax
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x400
sub ecx, dword [ebp - 0x40c]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x40c]
lea eax, [ebp + edx - 0x408]
push eax
call fcn.10019ea0
add esp, 0x10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret

Function at 0x10018700
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
cmp dword [0x100500dc], 1
jl 0x1001889e
mov dword [ebp - 4], 0
mov al, byte [0x10033426]
mov byte [ebp - 0x210], al
push 0x1ff
push 0
lea ecx, [ebp - 0x20f]
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xc], 0
push 0x200
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.10019d20
add esp, 0xc
push 0x100
push 0
lea eax, [ebp - 0x310]
push eax
call fcn.10019d20
add esp, 0xc
push 0x100500bc
push str.___s:
push 0x1ff
lea ecx, [ebp - 0x210]
push ecx
call fcn.10019db0
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, 0x200
sub eax, dword [ebp - 0xc]
sub eax, 1
push eax
mov ecx, dword [ebp - 0xc]
lea edx, [ebp + ecx - 0x210]
push edx
call fcn.10019ea0
add esp, 0x10
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x10018891
push 0
push 0x100
lea eax, [ebp - 0x310]
push eax
push 0x400
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x1003cee4
lea edx, [ebp - 0x310]
push edx
call fcn.10019fc0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001882d
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 0x100340e8
lea edx, [ebp - 0x310]
push edx
call fcn.10019fc0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10018850
mov eax, dword [ebp - 4]
mov byte [eax], 0
lea ecx, [ebp - 0x310]
push ecx
push str.:__s
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x200
sub ecx, eax
sub ecx, 1
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x210]
push eax
call fcn.10019db0
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret
Function at 0x100199e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
push 1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10019a25
mov edx, dword [ebp + 8]
push edx
push str.GetEnvVarW__:_GetEnvironmentVariableW__S__failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0xc
xor eax, eax
jmp 0x10019ab7
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.GetEnvVarW__:_variable__S_found__size_u
call fcn.10018570
add esp, 0xc
mov edx, dword [ebp - 4]
lea eax, [edx + edx + 2]
push eax
call fcn.10019ae0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10019a6b
push str.GetEnvVarW__:_mem_alloc___failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
xor eax, eax
jmp 0x10019ab7
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10019ab4
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.GetEnvVarW__:_GetEnvironmentVariableW__s__dwSize_u_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0x10
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.10019b10
add esp, 8
xor eax, eax
jmp 0x10019ab7
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1001ba30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x9c0], 1
jmp 0x1001ba60
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x9c0]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x9c0], ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x9c0], 0x270
jge 0x1001bad3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x9c0]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + ecx*4 - 4]
shr ecx, 0x1e
mov eax, dword [ebp + 0xc]
xor ecx, dword [eax + edx*4 - 4]
imul ecx, ecx, 0x6c078965
mov edx, dword [ebp + 0xc]
add ecx, dword [edx + 0x9c0]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x9c0]
mov eax, dword [ebp + 0xc]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x9c0]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + edx*4]
mov dword [eax + ecx*4], edx
jmp 0x1001ba4b
pop esi
pop ebp
ret
Function at 0x1001bae0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x9c0], 0x270
jl 0x1001bc12
mov dword [ebp - 8], 0
jmp 0x1001bb0b
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xe3
jge 0x1001bb62
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4]
and ecx, 0x80000000
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax + edx*4 + 4]
and edx, 0x7fffffff
or ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
xor eax, dword [edx + ecx*4 + 0x634]
mov ecx, dword [ebp - 4]
and ecx, 1
xor eax, dword [ecx*4 + 0x1004db3c]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4], eax
jmp 0x1001bb02
jmp 0x1001bb6d
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x26f
jge 0x1001bbc3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4]
and edx, 0x80000000
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*4 + 4]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + edx*4 - 0x38c]
mov edx, dword [ebp - 4]
and edx, 1
xor ecx, dword [edx*4 + 0x1004db3c]
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], ecx
jmp 0x1001bb64
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9bc]
and ecx, 0x80000000
mov edx, dword [ebp + 8]
mov eax, dword [edx]
and eax, 0x7fffffff
or ecx, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
shr ecx, 1
mov edx, dword [ebp + 8]
xor ecx, dword [edx + 0x630]
mov eax, dword [ebp - 4]
and eax, 1
xor ecx, dword [eax*4 + 0x1004db3c]
mov edx, dword [ebp + 8]
mov dword [edx + 0x9bc], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x9c0], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c0]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x9c0], eax
mov edx, dword [ebp - 4]
shr edx, 0xb
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001c820
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 1
mov dword [ebp - 8], 0x10
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1001c85f
or eax, 0xffffffff
jmp 0x1001c923
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1001c88b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 0xffffffff
jmp 0x1001c910
push 0x10
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10019d20
add esp, 0xc
mov eax, 2
mov word [ebp - 0x20], ax
movzx ecx, word [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0xffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x1001c8ef
mov dword [ebp - 0xc], 0xffffffff
jmp 0x1001c910
push 0x1f4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jge 0x1001c90b
mov dword [ebp - 0xc], 0xffffffff
jmp 0x1001c910
mov eax, dword [ebp - 4]
jmp 0x1001c923
cmp dword [ebp - 4], 0xffffffff
jbe 0x1001c920
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1001c930
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], 1
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x1001c961
or eax, 0xffffffff
jmp 0x1001ca4e
cmp dword [ebp + 0x10], 0
jne 0x1001c996
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1001c996
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x14], 0
je 0x1001c996
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.10019d20
add esp, 0xc
mov ecx, 2
mov word [ebp - 0x10], cx
movzx edx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x10
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1001ca2e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2733
je 0x1001c9fe
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xfffffffe
jmp 0x1001ca4e
push 0xffffffffffffffff
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push str.tcp_connect__:_connect____s:_u_returned__d_errWSAEWOULDBLOCK
call fcn.10018570
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x1001ca2c
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
jmp 0x1001ca4b
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push str.tcp_connect__:_connect____s:_u_success
call fcn.10018570
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x1001ca60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x1001ca79
or eax, 0xffffffff
jmp 0x1001cafa
cmp dword [ebp + 0xc], 0
jne 0x1001ca86
mov eax, 0xfffffffe
jmp 0x1001cafa
push 4
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.10019d20
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
je 0x1001cab4
mov eax, 1
jmp 0x1001cafa
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001cace
mov eax, 0xfffffffd
jmp 0x1001cafa
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x1001cae2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
jne 0x1001cae9
mov eax, 0xfffffffc
jmp 0x1001cafa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001d130
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001d16e
mov ecx, dword [ebp + 8]
push ecx
push str.check_lock_mutex__:_CreateMutex___s___failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0xc
xor eax, eax
jmp 0x1001d19d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1001d19a
mov edx, dword [ebp + 8]
push edx
push str.check_lock_mutex__:_Mutex__s_already_exists
call fcn.10018570
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [0x100522b0]
xor eax, eax
jmp 0x1001d19d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1001d1b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001d205
cmp dword [ebp + 8], 0
je 0x1001d1e2
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jmp 0x1001d1e9
mov dword [ebp - 8], str.NULL
mov edx, dword [ebp - 8]
push edx
push str.mutex_create__:_CreateMutex___s___failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0xc
xor eax, eax
jmp 0x1001d274
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1001d271
cmp dword [ebp + 8], 0
je 0x1001d220
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x1001d227
mov dword [ebp - 0xc], str.NULL
mov ecx, dword [ebp - 0xc]
push ecx
push str.mutex_create__:_Mutex__s_already_exists
call fcn.10018570
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.1001d280
add esp, 8
test eax, eax
jge 0x1001d271
push str.mutex_create__:_mutex_lock___failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call dword [0x100522b0]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001ec00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov dword [ebp - 4], 0
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x40c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1001ead0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001ec4a
xor eax, eax
jmp 0x1001ece3
mov dword [ebp - 0x410], 0
push 0
lea ecx, [ebp - 0x410]
push ecx
push 0x400
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001ec86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x1001ec84
jmp 0x1001ecd3
jmp 0x1001ecd3
cmp dword [ebp - 0x410], 0
jne 0x1001ec91
jmp 0x1001ecd3
mov ecx, dword [ebp - 0x40c]
add ecx, dword [ebp - 0x410]
mov dword [ebp - 0x40c], ecx
mov edx, dword [ebp - 0x414]
push edx
mov eax, dword [ebp - 0x410]
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.10022ef0
add esp, 0xc
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x410], 0
ja 0x1001ec4a
mov edx, dword [ebp - 4]
push edx
call dword [0x100522b0]
mov eax, dword [ebp - 0x414]
mov esp, ebp
pop ebp
ret

Function at 0x1001ecf0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1001ead0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001ed1b
jmp 0x1001ed9a
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001ed32
jmp 0x1001ed9a
mov edx, dword [ebp - 4]
add edx, 1
push edx
call fcn.10019ae0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1001ed4c
jmp 0x1001ed9a
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1001eb90
add esp, 0x10
test eax, eax
jne 0x1001ed6a
jmp 0x1001ed9a
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
je 0x1001ed74
jmp 0x1001ed9a
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 4]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
je 0x1001ed8b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
push edx
call dword [0x100522b0]
mov eax, dword [ebp - 0x10]
jmp 0x1001edc0
cmp dword [ebp - 8], 0
je 0x1001edaa
mov eax, dword [ebp - 8]
push eax
call dword [0x100522b0]
cmp dword [ebp - 0x10], 0
je 0x1001edbe
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.10019b10
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001f6b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1001f460
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001f6e5
or eax, 0xffffffff
jmp 0x1001f779
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.10019bc0
add esp, 0xc
test eax, eax
je 0x1001f74b
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
add ecx, dword [edx]
push ecx
call fcn.10019c40
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001f769
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.AddSeclogFile__:_mem_realloc___failed_pData__dwBufLen_u_dwBufLen_u
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0x10
push 0
lea ecx, [ebp - 8]
push ecx
call fcn.10019b10
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret