joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a150
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000a200
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000a250
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10030a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10030f24], 1
jne 0x1000a2ff
push 1
push 0x40
push 8
push 0x10020228
lea ecx, [ebp - 0x174]
call fcn.100014c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nST_Scan:
push eax
call fcn.10001050
lea eax, [ebp - 0x174]
push 0x1002024c
push eax
call fcn.10001050
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.10001f00
test eax, eax
jne 0x1000a2ed
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ab0
cmp dword [0x10030f34], 1
jne 0x1000a3de
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x10020274
call fcn.100014c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x10020278
push eax
call fcn.10001050
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.ST_Scan:
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.Speed_Hack_or_System_Freeze_detected_
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x100202c0
push eax
call fcn.10001050
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.10001f00
test eax, eax
jne 0x1000a3c6
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x100202e8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10001ab0
mov eax, dword [0x10030f28]
push 0
cmp eax, 1
jne 0x1000a410
push 0
push 0
push 0x1000a1a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000a420
push 0
push 0
push 0x1000a170
jmp 0x1000a3f3
cmp eax, 3
jne 0x1000a430
push 0
push 0
push 0x1000a1d0
jmp 0x1000a3f3
cmp eax, 4
jne 0x1000a40a
push 0
push 0
push 0x10018d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.ST_Scan
push str.Speed_Hack_detected_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000a408
Function at 0x1000aca0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10030a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10030f24], 1
jne 0x1000ad4f
push 1
push 0x40
push 8
push 0x10020660
lea ecx, [ebp - 0x174]
call fcn.100014c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_HB___Load_data_fail:
push eax
call fcn.10001050
lea eax, [ebp - 0x174]
push 0x10020690
push eax
call fcn.10001050
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.10001f00
test eax, eax
jne 0x1000ad3d
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ab0
cmp dword [0x10030f34], 1
jne 0x1000ae2e
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100206a8
call fcn.100014c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x100206ac
push eax
call fcn.10001050
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.HB___Load_data_fail:
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.Unable_to_load_data_
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x100206ec
push eax
call fcn.10001050
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.10001f00
test eax, eax
jne 0x1000ae16
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x10020714
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10001ab0
mov eax, dword [0x10030f28]
cmp eax, 1
je 0x1000ae6f
cmp eax, 3
je 0x1000ae6f
cmp eax, 4
je 0x1000ae6f
push 0
cmp eax, 2
jne 0x1000ae69
push 0
push 0
push 0x1000ae80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000aeb0
jmp 0x1000ae52
Function at 0x1000af00
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10030a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10030f24], 1
jne 0x1000af9e
push 1
push 0x40
push 8
push 0x10020780
lea ecx, [ebp - 0x174]
call fcn.100014c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_HB___FTP_Server_connection_fail_
push eax
call fcn.10001050
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.10001f00
test eax, eax
jne 0x1000af8c
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ab0
cmp dword [0x10030f34], 1
jne 0x1000b06c
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100207b8
call fcn.100014c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x100207bc
push eax
call fcn.10001050
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.HB___FTP_Server_connection_fail_
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x100207f0
push eax
call fcn.10001050
add esp, 0x24
lea ecx, [ebp - 0xc0]
call fcn.10001f00
test eax, eax
jne 0x1000b054
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x10020818
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10001ab0
mov eax, dword [0x10030f28]
cmp eax, 1
je 0x1000b0ad
cmp eax, 3
je 0x1000b0ad
cmp eax, 4
je 0x1000b0ad
push 0
cmp eax, 2
jne 0x1000b0a7
push 0
push 0
push 0x1000b0c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000b0f0
jmp 0x1000b090
Function at 0x1000b120
Capabilities:
Capture public ip
Connect to http server
Create http request
Delete file
Read data from internet
Receive data
Send file using ftp
Set file attributes

Disassembly:
sub esp, 0x3c
mov eax, dword [0x10030a98]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetOpenA]
push esi
push edi
push 0
push 0
push 0
push 1
push 0
call ebx
push 0
push 0
push 1
push dword [0x10030e98]
push dword [0x10030e94]
push 0x15
push dword [0x10030e90]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0
push 0
push 0
push 0
mov edi, eax
call ebx
push 0
push 0x80000000
push 0
push 0
push 0x10020954
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x1000b269
lea eax, [esp + 0xc]
push eax
push 0x2f
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0xc]
cmp eax, 0x2f
jae 0x1000b29d
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [esp + eax + 0x18], 0
call esi
push 0
push 2
lea eax, [esp + 0x1c]
push eax
push str.ggg_ng_n
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x1000b28a
push edi
call esi
push dword [esp + 0x10]
call esi
push 0
push 0
push 0
push 1
push 0
call ebx
push 0
push 0x8000000
push 1
push dword [0x10030e98]
mov edi, eax
push dword [0x10030e94]
push 0x15
push dword [0x10030e90]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 1
push 0x80
push 1
push 0x1002092c
mov ebx, eax
push 0x10020930
push ebx
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
je 0x1000b26e
push 2
push 0x10020948
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call esi
push edi
call esi
call fcn.1000bdb0
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100194a0
add esp, 0x3c
ret
call fcn.1000b2b0
mov esi, dword [sym.imp.ucrtbased.dll_remove]
push 0x1002094c
call esi
push 0x10020950
call esi
add esp, 8
call fcn.1000af00
push 0x10020970
call dword [sym.imp.ucrtbased.dll_remove]
add esp, 4
call fcn.1000af00
call fcn.10019640
int3
Function at 0x1000b2b0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10030a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10030f24], 1
jne 0x1000b34e
push 1
push 0x40
push 8
push 0x10020874
lea ecx, [ebp - 0x174]
call fcn.100014c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nHB___HTTP_connection_fail_
push eax
call fcn.10001050
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.10001f00
test eax, eax
jne 0x1000b33c
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ab0
cmp dword [0x10030f34], 1
jne 0x1000b41c
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100208a4
call fcn.100014c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x100208a8
push eax
call fcn.10001050
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.HB___HTTP_connection_fail_
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x100208d4
push eax
call fcn.10001050
add esp, 0x24
lea ecx, [ebp - 0xc0]
call fcn.10001f00
test eax, eax
jne 0x1000b404
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x100208fc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10001ab0
mov eax, dword [0x10030f28]
cmp eax, 1
je 0x1000b45d
cmp eax, 3
je 0x1000b45d
cmp eax, 4
je 0x1000b45d
push 0
cmp eax, 2
jne 0x1000b457
push 0
push 0
push 0x1000b470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000b4a0
jmp 0x1000b440
Function at 0x1000b4d0
Capabilities:
Create thread
Delete file
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10030a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10020568
call dword [sym.imp.ucrtbased.dll_remove]
add esp, 4
cmp dword [0x10030f24], 1
jne 0x1000b58d
push 1
push 0x40
push 8
push 0x1002056c
lea ecx, [ebp - 0x174]
call fcn.100014c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_Hardware_Banned:
push eax
call fcn.10001050
lea eax, [ebp - 0x174]
push str.Contact_Administrator_
push eax
call fcn.10001050
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.10001f00
test eax, eax
jne 0x1000b57b
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ab0
cmp dword [0x10030f34], 1
jne 0x1000b65b
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100205b0
call fcn.100014c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x100205b4
push eax
call fcn.10001050
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.HB___Hardware_Banned_
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x100205dc
push eax
call fcn.10001050
add esp, 0x24
lea ecx, [ebp - 0xc0]
call fcn.10001f00
test eax, eax
jne 0x1000b643
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x10020604
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10001ab0
mov eax, dword [0x10030f28]
cmp eax, 1
je 0x1000b69c
cmp eax, 3
je 0x1000b69c
cmp eax, 4
je 0x1000b69c
push 0
cmp eax, 2
jne 0x1000b696
push 0
push 0
push 0x1000ac40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000ac70
jmp 0x1000b67f
Function at 0x1000b6b0
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ucrtbased.dll_malloc]
push 0x14
mov dword [esp + 0x10], 4
call esi
push 0x288
mov ebp, eax
call esi
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1000b6f0
push 0x179
push 0x10020990
push 0x10020a14
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push ebx
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
call ebx
cmp eax, 0x6f
jne 0x1000b789
push dword [esp + 0xc]
call esi
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000b72e
push 0x17d
push 0x10020a40
push 0x10020ac4
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push esi
call ebx
test eax, eax
jne 0x1000b778
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push 0x10020aec
push ebp
call fcn.1000c930
add esp, 0x20
push esi
call dword [sym.imp.ucrtbased.dll_free]
add esp, 4
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.1000aca0
int3

Function at 0x1000b790
Capabilities:
Create thread
Delete file

Disassembly:
push esi
mov esi, dword [sym.imp.ucrtbased.dll_remove]
push 0x10020be4
call esi
push 0x10020c8c
call esi
push 0x10020c90
call esi
add esp, 0xc
push 0
push 0
push 0
push 0x1000c570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
Function at 0x1000c620
Capabilities:
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x6c
push 0xffffffffffffffff
push 0x1001b780
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x10030a98]
xor eax, ebp
mov dword [ebp + 0x68], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp]
mov dword [ebp], 0x64
push eax
lea eax, [ebp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1000c6e3
push 1
push 0x40
push 8
push 0x10020974
lea ecx, [ebp - 0xbc]
call fcn.100014c0
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 0
push 0x10020978
push eax
call fcn.10001050
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.10001050
add esp, 0x10
lea ecx, [ebp - 0xb8]
call fcn.10001f00
test eax, eax
jne 0x1000c6d3
push eax
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
call fcn.1000b120
lea ecx, [ebp - 0xbc]
call fcn.10001ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp + 0x68]
xor ecx, ebp
call fcn.100194a0
lea esp, [ebp + 0x6c]
pop ebp
ret
Function at 0x1000c970
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10030a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10030f24], 1
jne 0x1000ca35
push 1
push 0x40
push 8
push 0x10021088
lea ecx, [ebp - 0x174]
call fcn.100014c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nAL_Scan:
push eax
call fcn.10001050
add esp, 8
lea eax, [ebp - 0x174]
push 0x100210ac
push dword [0x10030ea0]
push eax
call fcn.10001050
add esp, 8
push eax
call fcn.10001050
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.10001f00
test eax, eax
jne 0x1000ca23
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ab0
cmp dword [0x10030f34], 1
jne 0x1000cb26
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100210c8
call fcn.100014c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x100210cc
push eax
call fcn.10001050
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.AL_Scan:
push eax
call fcn.10001050
add esp, 0x1c
lea eax, [ebp - 0xc4]
push str._are_not_running_on_system_
push dword [0x10030ea0]
push eax
call fcn.10001050
add esp, 8
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x10021108
push eax
call fcn.10001050
add esp, 0x10
lea ecx, [ebp - 0xc0]
call fcn.10001f00
test eax, eax
jne 0x1000cb0e
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x10021130
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10001ab0
mov eax, dword [0x10030f28]
push 0
cmp eax, 1
jne 0x1000cb58
push 0
push 0
push 0x1000ccc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000cb68
push 0
push 0
push 0x1000cc90
jmp 0x1000cb3b
cmp eax, 3
jne 0x1000cb78
push 0
push 0
push 0x1000ccf0
jmp 0x1000cb3b
cmp eax, 4
jne 0x1000cb52
push 0
push 0
push 0x10018d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.AL_Scan
push dword [0x10030ea0]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000cb50

Function at 0x1000cc70
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000cbb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000cd20
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000cd40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000ceb0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001aecb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
push edi
mov eax, dword [0x10030a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0
push edi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x1000d0db
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x10030f24], 1
jne 0x1000cf81
push 1
push 0x40
push 8
push 0x10021398
lea ecx, [ebp - 0x174]
call fcn.100014c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nCN_Scan:
push eax
call fcn.10001050
lea eax, [ebp - 0x174]
push edi
push eax
call fcn.10001050
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.10001f00
test eax, eax
jne 0x1000cf6f
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ab0
cmp dword [0x10030f34], 1
jne 0x1000d05c
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x100213bc
call fcn.100014c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x100213c0
push eax
call fcn.10001050
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.CN_Scan:
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x100213e0
push eax
call fcn.10001050
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.10001f00
test eax, eax
jne 0x1000d044
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x10021408
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10001ab0
mov eax, dword [0x10030f28]
push 0
cmp eax, 1
jne 0x1000d08e
push 0
push 0
push 0x1000d120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000d09e
push 0
push 0
push 0x1000d0f0
jmp 0x1000d071
cmp eax, 3
jne 0x1000d0ae
push 0
push 0
push 0x1000d150
jmp 0x1000d071
cmp eax, 4
jne 0x1000d088
push 0
push 0
push 0x10018d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.CN_Scan
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000d086
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret