joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c3420
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100f24c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010bb5c
mov word [ecx], ax
call fcn.10001e10
lea ecx, [esp + 0x30]
call fcn.100bcbd0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100bc9f0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100c34c6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100c34c6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c34c6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100c3cd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100f24c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x12
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010bba4
mov word [ecx], ax
call fcn.10001e10
lea ecx, [esp + 0x30]
call fcn.100bcbd0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100bc9f0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100c3d76
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100c3d76
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c3d76
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c3d90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f2908
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x12
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010bbcc
mov word [ecx], ax
call fcn.10001e10
lea ecx, [ebp - 0x18]
call fcn.100bcbd0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100d5ff0
test al, al
je 0x100c3e09
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100c3e3d
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100c3e3d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100c3e3d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100dd480
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x12
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010bbf4
mov word [ecx], ax
call fcn.10001e10
lea ecx, [ebp - 0x20]
call fcn.100bcbd0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100c3e84
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100c3ead
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100c3ead
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100c3ed6
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100c3ed6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c3ed6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c3f80
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100f24c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010bc1c
mov word [ecx], ax
call fcn.10001e10
lea ecx, [esp + 0x30]
call fcn.100bcbd0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100bc9f0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100c4026
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100c4026
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c4026
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c4040
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f2908
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010bc38
mov word [ecx], ax
call fcn.10001e10
lea ecx, [ebp - 0x18]
call fcn.100bcbd0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100d5ff0
test al, al
je 0x100c40b9
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100c40ed
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100c40ed
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100c40ed
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100de010
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010bc54
mov word [ecx], ax
call fcn.10001e10
lea ecx, [ebp - 0x20]
call fcn.100bcbd0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100c4134
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100c415d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100c415d
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100c4186
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100c4186
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c4186
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c4230
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100f24c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x13
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010bec8
mov word [ecx], ax
call fcn.10001e10
lea ecx, [esp + 0x30]
call fcn.100bcbd0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100bc9f0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100c42d6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100c42d6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c42d6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100c4380
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100f24c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xd
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010c3e0
mov word [ecx], ax
call fcn.10001e10
lea ecx, [esp + 0x30]
call fcn.100bcbd0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100bc9f0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100c4426
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100c4426
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c4426
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c5340
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3360
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010c5ac
mov word [ecx], ax
call fcn.10001e10
lea ecx, [ebp - 0x1c]
call fcn.100bcbd0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100d5ff0
test al, al
je 0x100c53bc
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x100c53f0
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100c53f0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100c53f0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
add ebx, 0xc
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push ebx
mov byte [ecx], 0
call fcn.10007d40
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 4]
call fcn.100df220
test al, al
je 0x100c5448
mov byte [ebp - 0xd], 1
jmp 0x100c5472
push str.insert_current_process_info_to_db...
push 1
push 0x4a
push 0x1010c5fc
push str.CProcessControl::InsertCurrentProcessInfoToDB
call fcn.100e13e0
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
add esp, 0x14
mov eax, dword [eax + 0x10]
push ebx
call eax
mov byte [ebp - 0xd], al
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010c638
mov word [ecx], ax
call fcn.10001e10
lea ecx, [ebp - 0x1c]
call fcn.100bcbd0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100c54ae
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100c54d7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100c54d7
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x100c5500
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100c5500
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c5500
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x100c552b
mov edi, dword [ebp - 0x24]
mov esi, ebx
cmp ebx, edi
je 0x100c5521
mov ecx, esi
call fcn.100c4670
add esi, 0x13c
cmp esi, edi
jne 0x100c5510
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c6580
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100f24c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1012d034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xa
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x1010c720
mov word [ecx], ax
call fcn.10001e10
lea ecx, [esp + 0x30]
call fcn.100bcbd0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100bc9f0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100c6626
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100c6626
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100c6626
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d2360
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
push str.start_websocket...
push 1
push 0xb6
push 0x1010dc28
push str.CClientWebsocket::Start
mov edi, ecx
call fcn.100e13e0
add esp, 0x14
cmp byte [0x101324e0], 0
jne 0x100d23a0
call fcn.100d2950
mov byte [0x101324e0], 1
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov byte [edi], 0
mov byte [0x10131a8d], 0
mov byte [0x10131a8c], 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 0xc8], eax
call esi
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [edi + 0xcc], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 1
push 0
mov dword [edi + 0xd4], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xd8], eax
lea eax, [esp + 8]
push eax
push 0
push edi
push 0x100d2a40
push 0
push 0
mov dword [esp + 0x20], 0
call esi
mov dword [edi + 0x38], eax
lea eax, [esp + 0xc]
push eax
push 0
push edi
push 0x100d2d80
push 0
push 0
mov dword [esp + 0x24], 0
call esi
mov dword [edi + 0x3c], eax
lea eax, [esp + 0x10]
push eax
push 0
push edi
push 0x100d21a0
push 0
push 0
mov dword [esp + 0x28], 0
call esi
mov dword [edi + 0xdc], eax
lea eax, [esp + 0x14]
push eax
push 0
push edi
push 0x100d22b0
push 0
push 0
mov dword [esp + 0x2c], 0
call esi
mov dword [edi + 0xe0], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100d2950
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x2c
mov esi, eax
lea eax, [ebp - 0x2c]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x30], 0x30
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x100d27c0
mov dword [ebp - 0x1c], esi
push eax
mov dword [ebp - 8], 0x1010dd88
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x100d29d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegisterClassEx_fail__code:__d_
push 3
push 0x1d8
push 0x1010dde0
push str.CClientWebsocket::CreateWnd
call fcn.100e1770
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0
push 0
push 0x64
push 0x64
push 0x64
push 0x64
push 0xcf0000
push str.CLIENTWEBSOCKET
push 0x1010de50
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x100d2a28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateWindowEx_fail__code:__d_
push 3
push 0x1df
push 0x1010de90
push 0x1010df44
call fcn.100e1770
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100d5210
Capabilities:
Terminate process

Disassembly:
push esi
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x100d5229
xor al, al
pop esi
ret
push ebx
push 0x666
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x100d524a
push 0x3e8
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
ret
Function at 0x100e11c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f572b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x1012d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.100e1860
add esp, 8
cmp byte [0x10131296], 0
mov dword [ebp - 4], 0
je 0x100e12e5
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x14], 0x10
jb 0x100e1250
mov ecx, dword [esi]
jmp 0x100e1252
mov ecx, esi
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
push ecx
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12c]
push str.__d._d._s._s___s_n
push eax
call fcn.100e1e70
add esp, 0x1c
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x118], 0x10
jb 0x100e12ca
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [0x1013129c]
test eax, eax
jne 0x100e1315
push 0x18
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [0x1013129c], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x1013129c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.100e7680
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x100e133f
push eax
push eax
call fcn.100e0e20
add esp, 8
push dword [0x1013129c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.100e7680
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x100e136d
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x100e136d
cmp ecx, 3
ja case.default.0x100e136d
jmp dword [ecx*4 + 0x100e13cc]
push esi
mov ecx, edi
call fcn.100e7150
jmp case.default.0x100e136d
push esi
mov ecx, edi
call fcn.100e7750
jmp case.default.0x100e136d
push esi
mov ecx, edi
call fcn.100e7c20
jmp case.default.0x100e136d
push esi
mov ecx, edi
call fcn.100e7490
cmp dword [ebp - 0x130], 0x10
jb 0x100e13b1
push dword [ebp - 0x144]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ebd7b
mov esp, ebp
pop ebp
ret
Function at 0x100e1c60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f5860
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1012d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.100e27e0
add esp, 4
cmp dword [ebp + 0x18], 0
jle 0x100e1e3c
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001a70
call fcn.100e20a0
add esp, 0x18
test al, al
je 0x100e1cdf
mov bl, 1
jmp 0x100e1e3e
call fcn.100e2410
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10007140
mov esi, eax
add esp, 0xc
lea eax, [ebp + 8]
cmp eax, esi
je 0x100e1d2c
cmp dword [ebp + 0x1c], 8
jb 0x100e1d0f
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.10001910
cmp dword [ebp - 0x14], 8
jb 0x100e1d3d
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [ebp + 8]
push eax
call fcn.100e22b0
mov ecx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
cmp ecx, esi
jbe 0x100e1ded
cmp ecx, esi
jbe 0x100e1e31
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
cmp word [eax + esi*2], 0x5c
jne 0x100e1de4
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.1000da60
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.10001a70
call fcn.100e20a0
add esp, 0x18
test al, al
jne 0x100e1dcc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x100e1de1
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp + 0x18]
inc esi
cmp ecx, esi
ja 0x100e1d67
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call edi
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001a70
call fcn.100e20a0
add esp, 0x18
test al, al
je 0x100e1e3c
mov bl, 1
jmp 0x100e1e3e
push str.invalid_string_position
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xout_of_range_char_const__]
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x100e1e4f
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ebd7b
mov esp, ebp
pop ebp
ret
Function at 0x100e20a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f58f8
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x1012d034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.100e22b0
add esp, 4
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x100e20fe
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret