joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b87e0
Capabilities:
Suspend thread

Disassembly:
push edi
mov edi, eax
mov eax, dword [0x100ff114]
test eax, eax
jne 0x100b8855
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, eax
jne 0x100b87fa
xor eax, eax
pop edi
ret
push esi
push 8
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x100b8810
lea edi, [eax + 8]
jmp 0x100b882d
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100b8842
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
mov dword [0x100ff114], edi
mov eax, edi
mov dword [0x100ff118], 0
pop edi
ret
mov eax, dword [0x100ff11c]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x100ff11c], esi
xor eax, eax
pop esi
pop edi
ret
Function at 0x100b8ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100ff110], eax
je 0x100b8adc
mov eax, 0x10dd
pop ebp
ret 8
mov eax, dword [0x100ff114]
test eax, eax
jne 0x100b8bd2
test ebp, ebp
jne 0x100b8af4
lea eax, [ebp + 6]
pop ebp
ret 8
cmp dword [ebp], 0
jne 0x100b8b0e
mov eax, 6
mov dword [0x100ff118], ebp
mov dword [0x100ff114], eax
pop ebp
ret 8
push ebx
push esi
push edi
push 0x18
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100b8b29
lea esi, [eax + 8]
jmp 0x100b8bb4
mov ecx, dword [ebp]
call fcn.100b8390
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.100b8390
movzx ecx, byte [edi + 0x36]
mov esi, dword [edi + 0x40]
sub esi, ecx
test ecx, ecx
je 0x100b8ba6
cmp ecx, 0x1e
ja 0x100b8ba6
cmp dword [edi + 0x44], eax
jne 0x100b8ba6
lea eax, [esp + 0x14]
push eax
push 0x40
push ecx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100b8b78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x100b8bb4
mov edx, dword [0x100ff120]
mov dword [ebx + 0x10], edi
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], esi
pop edi
mov dword [ebx + 4], 1
mov ecx, dword [esp + 0x10]
pop esi
mov dword [ebx + 0x14], ecx
mov dword [ebx], edx
mov dword [0x100ff120], ebx
pop ebx
xor eax, eax
pop ebp
ret 8
cmp dword [0x100ff108], 0
mov esi, 9
jne 0x100b8bba
mov dword [0x100ff114], esi
test ebx, ebx
je 0x100b8bc7
push ebx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
mov eax, esi
pop esi
mov dword [0x100ff118], ebp
pop ebx
pop ebp
ret 8

Function at 0x100b9370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100c49d1
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.100b9210
lea esi, [esp + 0x1c]
mov dword [esp + 0x58], 0
call fcn.100ac290
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c], 1
call fcn.100ac300
mov edx, dword [ebp + 8]
lea ecx, [esp + 0xc]
call fcn.100ac540
call fcn.100ac470
mov ecx, esi
mov byte [esp + 0x58], 0
call fcn.100ac470
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100b9410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100c49d1
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.100b92c0
lea esi, [esp + 0x1c]
mov dword [esp + 0x58], 0
call fcn.100ac290
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c], 1
call fcn.100ac300
mov edx, dword [ebp + 8]
lea ecx, [esp + 0xc]
call fcn.100ac540
call fcn.100ac470
mov ecx, esi
mov byte [esp + 0x58], 0
call fcn.100ac470
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100b95d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100c4998
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0xc]
and eax, 0xffffff05
or eax, 5
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov byte [esp + 4], al
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
call fcn.100ac300
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x14]
call fcn.100ac540
call fcn.100ac470
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
call fcn.100ac470
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x100ba2f9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100fc018]
jne 0x100ba303
repz ret
jmp fcn.100ba921
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3d8d6a04
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7c217fc3
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x414dd9
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [esi], edi
sub ebx, ecx
push ebx
pop ecx
add esi, 4
mov ecx, 0xb916d9b7
cmp esi, eax
jne fcn.00414dd9
or ecx, edx
sub ecx, 0x3070627d
ret
Function at 0x10005a00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b7ea
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
sub esp, 0x18
mov ecx, esp
push edi
call fcn.1000c680
lea eax, [ebp - 0x60]
push eax
call fcn.1000a7a0
add esp, 0x1c
mov esi, eax
push 5
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x48]
push str.SCAN
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.1000ef80
push esi
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
call fcn.1000c420
mov edx, dword [ebp - 0x34]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x10005ac4
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10005aba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005c15
push edx
push ecx
call fcn.100133fe
add esp, 8
mov edx, dword [ebp - 0x4c]
mov byte [ebp - 4], 4
cmp edx, 0x10
jb 0x10005afc
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10005af2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005c15
push edx
push ecx
call fcn.100133fe
add esp, 8
cmp dword [edi + 0x14], 8
mov eax, edi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
jb 0x10005b18
mov eax, dword [edi]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call fcn.1000fb50
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x10005bb1
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x80000
ja 0x10005b90
cmp dword [ebp - 0x14], 0
jne 0x10005b90
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
mov ecx, ebx
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.10005f60
test al, al
je 0x10005ba6
mov ecx, ebx
mov byte [ebx + 0x415c], 1
call fcn.10006010
push esi
mov byte [ebx + 0x415c], 0
call fcn.1000f9e0
add esp, 4
jmp 0x10005bc7
push 4
push str.:_OK
mov ecx, edi
call fcn.1000edf0
push edi
mov ecx, ebx
call fcn.100067e0
push esi
call fcn.1000f9e0
add esp, 4
jmp 0x10005bc7
push 4
push str.:_OK
mov ecx, edi
call fcn.1000edf0
push edi
mov ecx, ebx
call fcn.100067e0
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x10005bf7
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10005bed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005c1a
push edx
push ecx
call fcn.100133fe
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret 4
call fcn.1001e389
call fcn.1001e389
int3
Function at 0x10005f60
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push dword [edi + 0x78]
call dword [0x1007e20c]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x78], eax
lea esi, [edi + 0x40c0]
mov eax, 2
mov word [esi], ax
lea eax, [edi + 0x40c4]
push eax
push 0x1004d5c4
push 2
call sub.WS2_32.dll_InetPtonW
mov eax, 0xcee
add ax, word [edi + 0x4170]
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
push esi
push dword [edi + 0x78]
mov word [edi + 0x40c2], ax
call dword [0x1007e208]
cmp eax, 0xffffffff
je 0x10005ffb
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005fd7
push 0
sub eax, edx
push eax
push ebx
push dword [edi + 0x78]
call dword [0x1007e210]
cmp eax, 0xffffffff
je 0x10005ffb
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x10007a40
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ba97
mov eax, dword fs:[0]
push eax
sub esp, 0x6ac
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.QueryFullProcessImageNameW
push eax
mov dword [ebp - 0x698], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [edi + 0x40d0]
add edi, 0x40d0
mov ecx, edi
push dword [esi + 4]
push edi
call fcn.1000c160
mov dword [esi + 4], esi
xor eax, eax
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [ebp - 0x28], 0
mov dword [edi + 4], 0
mov dword [ebp - 0x26c], 0x22c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
push eax
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x26c]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x10007c3f
lea eax, [ebp - 0x26c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x10007c3f
nop word [eax + eax]
push dword [ebp - 0x264]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x694], 0x428
lea eax, [ebp - 0x694]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x10007c20
nop
xor eax, eax
mov dword [ebp - 0x6b0], 0
mov word [ebp - 0x6b0], ax
lea eax, [ebp - 0x474]
mov dword [ebp - 0x6a0], 0
lea edx, [eax + 2]
mov dword [ebp - 0x69c], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10007b90
sub eax, edx
lea ecx, [ebp - 0x6b0]
sar eax, 1
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.1000f080
lea eax, [ebp - 0x6b0]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x6b8]
mov ecx, edi
push eax
call fcn.1000bd20
mov edx, dword [ebp - 0x69c]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x10007c0b
mov ecx, dword [ebp - 0x6b0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10007c01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c70
push edx
push ecx
call fcn.100133fe
add esp, 8
lea eax, [ebp - 0x694]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10007b60
push esi
call fcn.1000f9e0
add esp, 4
lea eax, [ebp - 0x26c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x10007b30
push ebx
call fcn.1000f9e0
add esp, 4
push dword [ebp - 0x698]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
call fcn.1001e389
int3
Function at 0x10008780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
push edi
push 0x44
push 0
lea eax, [ebx + 0x40e0]
mov dword [ebp - 8], ebx
push eax
call fcn.100158a0
add esp, 0xc
mov ecx, 0x1007e0cc
call fcn.1000dc00
lea ecx, [ebx + 0x407c]
mov byte [ebx + 0x40dd], 0
mov byte [ebx + 0x40da], 0
mov byte [ebx + 0x29], 0
call fcn.1000ea20
lea esi, [ebx + 0x4130]
mov dword [ebx + 0x40a4], 0
mov dword [ebx + 0x416c], 0
push esi
push dword [esi + 4]
push dword [esi]
call fcn.1000bcb0
mov eax, dword [esi]
lea edi, [ebx + 0x413c]
mov dword [esi + 4], eax
push edi
push dword [edi + 4]
push dword [edi]
call fcn.1000bcb0
mov eax, dword [edi]
xor ecx, ecx
mov dword [edi + 4], eax
add esp, 0x18
mov dword [ebp - 4], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebp + 8]
mov byte [ebx + 0x40dc], 1
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1000887d
xor edi, edi
mov eax, dword [esi + 4]
lea ecx, [edi + ebx]
push ecx
cmp eax, dword [esi + 8]
je 0x1000884f
mov ecx, eax
call fcn.1000c680
add dword [esi + 4], 0x18
jmp 0x10008857
push eax
mov ecx, esi
call fcn.1000bee0
mov eax, dword [ebp + 8]
add edi, 0x18
inc dword [ebp - 4]
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 4], eax
jb 0x10008836
mov esi, dword [ebp - 8]
push 0
push 0
push esi
push 0x10003e50
push 0
push 0
call fcn.100298e0
add esp, 0x18
mov dword [esi + 0x416c], eax
mov ecx, 0x1007e0cc
call fcn.1000e480
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100088b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
push edi
push 0x44
push 0
lea eax, [ebx + 0x40e0]
mov dword [ebp - 0xc], ebx
push eax
call fcn.100158a0
add esp, 0xc
mov ecx, 0x1007e0cc
call fcn.1000dc00
lea ecx, [ebx + 0x407c]
mov byte [ebx + 0x40dd], 0
mov byte [ebx + 0x40da], 0
mov byte [ebx + 0x29], 0
call fcn.1000ea20
lea esi, [ebx + 0x4130]
mov dword [ebx + 0x40a4], 0
mov dword [ebx + 0x416c], 0
push esi
push dword [esi + 4]
push dword [esi]
call fcn.1000bcb0
mov eax, dword [esi]
mov dword [esi + 4], eax
lea esi, [ebx + 0x413c]
push esi
push dword [esi + 4]
push dword [esi]
call fcn.1000bcb0
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
add esp, 0x18
mov dword [esi + 4], eax
mov eax, 0x2aaaaaab
mov byte [ebx + 0x40dc], 1
mov ebx, dword [edi + 4]
mov edi, dword [edi]
mov dword [ebp - 4], ecx
mov ecx, ebx
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x100089b7
xor ebx, ebx
mov eax, dword [esi + 4]
lea ecx, [ebx + edi]
push ecx
cmp eax, dword [esi + 8]
je 0x10008981
mov ecx, eax
call fcn.1000c680
add dword [esi + 4], 0x18
jmp 0x10008989
push eax
mov ecx, esi
call fcn.1000bee0
mov ecx, dword [ebp + 8]
add ebx, 0x18
inc dword [ebp - 4]
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], eax
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 4], eax
jb 0x10008968
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
sub ebx, edi
mov eax, 0x2aaaaaab
imul ebx
push 0
push 0
sar edx, 2
push esi
mov eax, edx
push 0x10003e50
shr eax, 0x1f
add eax, edx
push 0
push 0
mov dword [esi + 0x40fc], eax
call fcn.100298e0
add esp, 0x18
mov dword [esi + 0x416c], eax
mov ecx, 0x1007e0cc
call fcn.1000e480
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10009450
Capabilities:
Check if file exists
Check mutex on windows
Create thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1005fd72], 0
push edi
mov edi, ecx
je 0x10009617
mov eax, 0x64
mov dword [ebp - 0xa], 0x6d0054
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x10]
push eax
push 0x5a0
mov dword [ebp - 0x10], 0x700055
call fcn.10009630
test eax, eax
je 0x10009617
mov eax, dword [edi + 0x4178]
or eax, dword [edi + 0x417c]
push ebx
push esi
lea esi, [edi + 0x4178]
jne 0x10009505
cmp dword [edi + 0x41b0], 8
lea eax, [edi + 0x419c]
jb 0x100094ca
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call fcn.1000fb50
mov ebx, eax
add esp, 0x1c
cmp ebx, 0xffffffff
je 0x10009505
push 0
lea eax, [ebp - 0x1c]
push eax
push 8
push esi
push ebx
call dword [0x1007e1ec]
push ebx
call fcn.1000f9e0
add esp, 4
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
push eax
movups xmmword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x18], xmm0
call fcn.10010180
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1000ff10
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
or ebx, dword [ebp - 0x18]
and ecx, 0x7fffffff
add esp, 0xc
mov edx, ebx
sub edx, dword [esi]
mov eax, ecx
sbb eax, dword [esi + 4]
cmp eax, 0xc9
jl 0x10009615
jg 0x1000955a
cmp edx, 0x2b025680
jb 0x10009615
lea eax, [edi + 0x419c]
mov dword [esi], ebx
mov dword [esi + 4], ecx
cmp dword [eax + 0x14], 8
jb 0x1000956d
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call fcn.1000fb50
mov ebx, eax
add esp, 0x1c
cmp ebx, 0xffffffff
je 0x100095a8
push 0
lea eax, [ebp - 0x20]
push eax
push 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.1000f9e0
add esp, 4
push str.GlobalDinyiAPCPDBUpdMutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x100095d8
push eax
call fcn.1000f9e0
add esp, 4
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10009615
cmp dword [0x1005fd7c], 0
je 0x100095fa
mov eax, dword [0x1005fd7c]
push eax
call fcn.1000f9e0
add esp, 4
push 0
push 0
push edi
push 0x100031f0
push 0
push 0
call fcn.100298e0
add esp, 0x18
mov dword [0x1005fd7c], eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x1000a300
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xce4
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x43c]
push 0x400
push 0
push eax
mov dword [ebp - 0xce4], esi
call fcn.100158a0
mov eax, 0x2e
mov dword [ebp - 0x22], 0x2a
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x2c]
push esi
push eax
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x2c], 0x730025
push eax
mov dword [ebp - 0x28], 0x2a005c
call dword [0x1007e230]
add esp, 0x18
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [0x1007e1f0]
mov ebx, eax
mov dword [ebp - 0xce0], ebx
cmp ebx, 0xffffffff
je 0x1000a573
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test byte [ebp - 0xcdc], 0x10
je 0x1000a555
cmp word [ebp - 0xcb0], 0x2e
je 0x1000a555
cmp word [ebp - 0xcae], 0x2e
je 0x1000a555
lea eax, [ebp - 0xcb0]
mov dword [ebp - 0xc], 0x25005c
push eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x73
push eax
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x10], 0x730025
push eax
call dword [0x1007e230]
push 0x400
lea eax, [ebp - 0x83c]
push 0
push eax
call fcn.100158a0
mov eax, 0x2e
mov dword [ebp - 0x32], 0x2a
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x730025
push eax
lea eax, [ebp - 0x83c]
mov dword [ebp - 0x38], 0x2a005c
push eax
call dword [0x1007e230]
add esp, 0x28
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x83c]
push eax
call dword [0x1007e1f0]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000a542
test byte [ebp - 0xa8c], 0x10
jne 0x1000a51f
mov ecx, 0x1004d554
lea eax, [ebp - 0xa60]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000a496
test dx, dx
je 0x1000a492
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000a496
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000a470
xor eax, eax
jmp 0x1000a49b
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000a51f
mov eax, 0x1004d558
lea ecx, [ebp - 0xa60]
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1000a4d6
test dx, dx
je 0x1000a4d2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1000a4d6
add ecx, 4
add eax, 4
test dx, dx
jne 0x1000a4b0
xor eax, eax
jmp 0x1000a4db
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000a51f
lea eax, [ebp - 0xa60]
mov dword [ebp - 0x18], 0x25005c
push eax
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x14], 0x73
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x730025
push eax
lea eax, [ebp - 0x83c]
push eax
call dword [0x1007e230]
add esp, 0x10
lea eax, [ebp - 0x83c]
push eax
call edi
lea eax, [ebp - 0xa8c]
push eax
push esi
call dword [0x1007e1f4]
test eax, eax
jne 0x1000a452
push esi
call dword [0x1007e1f8]
mov ebx, dword [ebp - 0xce0]
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [ebp - 0xce4]
lea eax, [ebp - 0xcdc]
push eax
push ebx
call dword [0x1007e1f4]
test eax, eax
jne 0x1000a390
push ebx
call dword [0x1007e1f8]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret