joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10117100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], ecx
mov eax, dword [ebp - 0x108]
movzx ecx, byte [eax + 4]
and ecx, 2
jne 0x1011712a
jmp 0x1011717c
mov edx, dword [ebp - 0x108]
add edx, 0x45
push edx
push str.XTEAM_MAIN_10405__s
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x10117174
lea edx, [ebp - 0x104]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x1011717c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret

Function at 0x10117190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf4b
mov eax, dword fs:[0]
push eax
sub esp, 0x510
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x25c], 0
jne 0x101171d5
jmp 0x101172d5
push 0x104
push 0
lea ecx, [ebp - 0x114]
push ecx
call fcn.1019bb90
add esp, 0xc
push 0x104
lea edx, [ebp - 0x114]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1011720b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0xd3
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.10122d50
add esp, 4
push eax
call fcn.101ad47c
add esp, 8
test eax, eax
je 0x1011723b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x51c]
add eax, 0xd3
push eax
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx ecx, al
test ecx, ecx
jne 0x10117293
push 0x10
push 0x101f9400
push 0x101f9408
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x51c]
mov eax, dword [edx + 0x25c]
cmp eax, dword [ebp - 0x118]
je 0x101172c3
push 0x10
push 0x101f941c
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x101172f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf8b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x260], 0
jne 0x10117335
jmp 0x1011746e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0xf3
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x1011738e
push 0x10
push 0x101f9438
push str.Plugin_1_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x260]
cmp edx, dword [ebp - 0x118]
je 0x101173aa
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0xf3
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x101173d3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10117419
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x260]
cmp ecx, dword [ebp - 0x118]
je 0x10117435
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f9454
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x1011745c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x10117490
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf8b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x264], 0
jne 0x101174d5
jmp 0x1011760e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x113
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x1011752e
push 0x10
push 0x101f9460
push str.Plugin_2_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x264]
cmp edx, dword [ebp - 0x118]
je 0x1011754a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x113
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10117573
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x101175b9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x264]
cmp ecx, dword [ebp - 0x118]
je 0x101175d5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f947c
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x101175fc
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x10117630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf8b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x268], 0
jne 0x10117675
jmp 0x101177ae
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x133
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x101176ce
push 0x10
push 0x101f9488
push str.Plugin_3_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x268]
cmp edx, dword [ebp - 0x118]
je 0x101176ea
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x133
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10117713
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10117759
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x268]
cmp ecx, dword [ebp - 0x118]
je 0x10117775
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f94a4
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x1011779c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x101177d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf8b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x26c], 0
jne 0x10117815
jmp 0x1011794e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x153
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x1011786e
push 0x10
push 0x101f94b0
push str.Plugin_4_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x26c]
cmp edx, dword [ebp - 0x118]
je 0x1011788a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x153
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x101178b3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x101178f9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x26c]
cmp ecx, dword [ebp - 0x118]
je 0x10117915
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f94cc
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x1011793c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x10117970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf8b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x270], 0
jne 0x101179b5
jmp 0x10117aee
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x173
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x10117a0e
push 0x10
push 0x101f94d8
push str.Plugin_5_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x270]
cmp edx, dword [ebp - 0x118]
je 0x10117a2a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x173
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10117a53
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10117a99
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x270]
cmp ecx, dword [ebp - 0x118]
je 0x10117ab5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f94f4
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x10117adc
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x10117b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf8b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x274], 0
jne 0x10117b55
jmp 0x10117c8e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x193
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x10117bae
push 0x10
push 0x101f9500
push str.Plugin_Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x274]
cmp edx, dword [ebp - 0x118]
je 0x10117bca
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x193
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10117bf3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10117c39
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x274]
cmp ecx, dword [ebp - 0x118]
je 0x10117c55
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f9524
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x10117c7c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x10117cb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf8b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x278], 0
jne 0x10117cf5
jmp 0x10117e2e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x1b3
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x10117d4e
push 0x10
push str.Error
push str.Plugin_HackDLL_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x278]
cmp edx, dword [ebp - 0x118]
je 0x10117d6a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x1b3
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10117d93
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10117dd9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x278]
cmp ecx, dword [ebp - 0x118]
je 0x10117df5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f9554
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x10117e1c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x1011a870
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 6]
cmp ecx, 1
jne 0x1011a906
push 1
mov ecx, 0x104e1600
call fcn.100b1bf0
mov dword [ebp - 0xc], 0
jmp 0x1011a8a4
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp dword [ebp - 0xc], ecx
jge 0x1011a904
imul edx, dword [ebp - 0xc], 0x1a
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 7]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x14
push ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0xe]
push eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 0x12]
push edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 1
push edx
mov ecx, 0x104e1600
call fcn.100b1c90
jmp 0x1011a89b
jmp 0x1011a981
push 0
mov ecx, 0x104e1600
call fcn.100b1bf0
mov dword [ebp - 0x10], 0
jmp 0x1011a924
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 5]
cmp dword [ebp - 0x10], edx
jge 0x1011a981
imul eax, dword [ebp - 0x10], 0x1a
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 7]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x18]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x14
push edx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0xe]
push ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x12]
push eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, 0x104e1600
call fcn.100b1c90
jmp 0x1011a91b
mov esp, ebp
pop ebp
ret

Function at 0x1011b430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 0x80f8e0
call eax
cmp dword [0xe609e8], 5
je 0x1011b449
jmp 0x1011b4fb
cmp dword [0x10217f7c], 1
je 0x1011b457
jmp 0x1011b4fb
movzx ecx, byte [0x10214fdc]
test ecx, ecx
je 0x1011b480
push 0
push 0
push 0
push 2
call fcn.1011b910
add esp, 0x10
mov edx, 0x63a180
mov ecx, 0x8793750
call edx
jmp 0x1011b4fb
call fcn.1011b500
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10217f70]
cmp eax, dword [0x10217f68]
jbe 0x1011b4b7
push 0
push 0
push 0
push 2
call fcn.1011b910
add esp, 0x10
mov eax, 0x63a180
mov ecx, 0x8793750
call eax
jmp 0x1011b4fb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10217f74]
cmp eax, dword [0x10217f6c]
jae 0x1011b4cd
jmp 0x1011b4fb
mov ecx, dword [0x10217f78]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x1011b4e4
cmp dword [ebp - 4], 1
je 0x1011b4eb
jmp 0x1011b4f0
call fcn.1011b9a0
jmp 0x1011b4f0
call fcn.1011b9e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10217f74], eax
mov esp, ebp
pop ebp
ret
Function at 0x1011b910
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [0x10217f7c], eax
mov ecx, dword [ebp + 0xc]
mov dword [0x10217f78], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10217f74], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10217f70], eax
mov edx, dword [ebp + 0x10]
mov dword [0x10217f6c], edx
mov eax, dword [ebp + 0x14]
mov dword [0x10217f68], eax
cmp dword [ebp + 8], 0
jne 0x1011b95d
mov dword [ebp - 4], 0
jmp 0x1011b966
mov ecx, dword [0x10217f64]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [0x10217f64], edx
cmp dword [ebp + 8], 0
jne 0x1011b97e
mov dword [ebp - 8], 0
jmp 0x1011b986
mov eax, dword [0x10217f60]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [0x10217f60], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1011ccd0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], 0x288
push 0x12
call fcn.101a3ce9
add esp, 4
mov dword [ebp - 0x14], eax
push 0x288
call fcn.101a3ce9
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1011cd2d
push 0x101f9618
call sym.Client_Clean_.dll_printf
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call fcn.101a40fe
add esp, 4
xor eax, eax
jmp 0x1011ce6e
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1011cd81
mov eax, dword [ebp - 0x10]
push eax
call fcn.101a40fe
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.101a3ce9
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1011cd81
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call sym.Client_Clean_.dll_printf
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.101a40fe
add esp, 4
xor eax, eax
jmp 0x1011ce6e
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1011ce5f
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
shl ecx, 2
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
imul edx, ecx, 3
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 1
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + eax + 0x194]
push edx
push str._02X:_02X:_02X:_02X:_02X:_02X
mov eax, dword [ebp - 0x14]
push eax
call sym.Client_Clean_.dll_sprintf
add esp, 0x20
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1b0
push edx
push str.Address:__s__mac:__s_n
call sym.Client_Clean_.dll_printf
add esp, 0xc
push 0x101f96c0
call sym.Client_Clean_.dll_printf
add esp, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x1011cd9d
mov edx, dword [ebp - 0x10]
push edx
call fcn.101a40fe
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret