joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004ca0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x402]
push eax
call fcn.1000f6d0
push ebx
lea eax, [ebp - 0x404]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004d79
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10004d10
test byte [ebp - 0x654], 0x10
je 0x10004d5f
cmp word [ebp - 0x628], 0x2e
je 0x10004d5f
cmp word [ebp - 0x626], 0x2e
je 0x10004d5f
lea eax, [ebp - 0x628]
push eax
push ebx
lea eax, [ebp - 0x404]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x404]
push eax
call fcn.10004d90
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call edi
lea eax, [ebp - 0x654]
push eax
push esi
call dword [0x1006a8c4]
test eax, eax
jne 0x10004d10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000eb51
mov esp, ebp
pop ebp
ret

Function at 0x10004ee0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
xor bl, bl
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10005035
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1000502e
push edi
mov edi, eax
mov edi, edi
lea eax, [ebp - 0x20c]
push eax
push str.avgcsrvx.exe
call fcn.1000d95b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgemcx.exe
cmove ebx, edi
call fcn.1000d95b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgidsagent.exe
cmove ebx, edi
call fcn.1000d95b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgnsx.exe
cmove ebx, edi
call fcn.1000d95b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgrsx.exe
cmove ebx, edi
call fcn.1000d95b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgsvcx.exe
cmove ebx, edi
call fcn.1000d95b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgui.exe
cmove ebx, edi
call fcn.1000d95b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avguix.exe
cmove ebx, edi
call fcn.1000d95b
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgwdsvcx.exe
cmove ebx, edi
call fcn.1000d95b
add esp, 8
test eax, eax
lea eax, [ebp - 0x230]
movzx ebx, bl
push eax
push esi
cmove ebx, edi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x10004f30
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1000eb51
mov esp, ebp
pop ebp
ret
Function at 0x100050b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a6a8
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x450]
push eax
push esi
mov dword [ebp - 0x450], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x100051a9
jmp 0x10005110
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x230], ax
je 0x10005145
lea eax, [ebp - 0x230]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005136
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x28]
call fcn.100092e0
movzx eax, byte [0x1006a890]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x458]
push eax
lea ecx, [edi + 0x40d0]
mov dword [ebp - 4], 0
call fcn.10001860
cmp dword [ebp - 0x14], 8
mov dword [ebp - 4], 0xffffffff
jb 0x10005194
push dword [ebp - 0x28]
call fcn.1000c91a
add esp, 4
lea eax, [ebp - 0x450]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10005110
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb51
mov esp, ebp
pop ebp
ret 4
Function at 0x10005e80
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a7d1
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xff
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.1000f6d0
add esi, 0x414c
xor eax, eax
add esp, 0xc
mov byte [esi], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x12c], 7
mov dword [ebp - 0x130], 0
mov word [ebp - 0x140], ax
cmp word [0x1006a688], ax
jne 0x10005f09
xor ecx, ecx
jmp 0x10005f20
mov ecx, 0x1006a688
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005f11
sub ecx, edx
sar ecx, 1
push ecx
push 0x1006a688
lea ecx, [ebp - 0x140]
call fcn.100092e0
push str.Databasedaily.cld
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 4], 0
call fcn.100013b0
add esp, 0xc
cmp dword [ebp - 0x12c], 8
mov byte [ebp - 4], 2
jb 0x10005f6e
push dword [ebp - 0x140]
call fcn.1000c91a
add esp, 4
xor eax, eax
cmp dword [ebp - 0x114], 8
mov word [ebp - 0x140], ax
lea eax, [ebp - 0x128]
cmovae eax, dword [ebp - 0x128]
push eax
mov dword [ebp - 0x12c], 7
mov dword [ebp - 0x130], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000606e
push 0x1006a688
lea ecx, [ebp - 0x170]
call fcn.10001ce0
push str.Databasedaily.cvd
push eax
lea eax, [ebp - 0x158]
push eax
mov byte [ebp - 4], 3
call fcn.100013b0
mov edi, eax
lea eax, [ebp - 0x128]
add esp, 0xc
cmp eax, edi
je 0x10006023
cmp dword [ebp - 0x114], 8
jb 0x10005ffa
push dword [ebp - 0x128]
call fcn.1000c91a
add esp, 4
xor eax, eax
push edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x114], 7
mov dword [ebp - 0x118], 0
mov word [ebp - 0x128], ax
call fcn.10007fa0
cmp dword [ebp - 0x144], 8
jb 0x1000603a
push dword [ebp - 0x158]
call fcn.1000c91a
add esp, 4
xor eax, eax
cmp dword [ebp - 0x15c], 8
mov dword [ebp - 0x144], 7
mov dword [ebp - 0x148], 0
mov word [ebp - 0x158], ax
jb 0x1000606e
push dword [ebp - 0x170]
call fcn.1000c91a
add esp, 4
cmp dword [ebp - 0x114], 8
push 0
push 0x80
push 3
push 0
push 1
lea eax, [ebp - 0x128]
cmovae eax, dword [ebp - 0x128]
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100060ed
push 0
lea eax, [ebp - 0x174]
push eax
push 0x100
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xed]
push 0x1003cadc
push eax
call fcn.1000d518
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x100060ed
sub esi, ecx
mov al, byte [ecx]
mov byte [esi + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x100060e1
cmp dword [ebp - 0x114], 8
jb 0x10006104
push dword [ebp - 0x128]
call fcn.1000c91a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb51
mov esp, ebp
pop ebp
ret
Function at 0x10006280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a858
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
push eax
push 2
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100062f9
lea eax, [ebp - 0x254]
push eax
push esi
mov dword [ebp - 0x254], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x10006330
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
cmp dword [ebp - 0x14], 8
jb 0x1000630c
push dword [ebp - 0x28]
call fcn.1000c91a
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb51
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x230], 0
jne 0x1000633e
xor eax, eax
jmp 0x10006356
lea eax, [ebp - 0x230]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006347
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x28]
call fcn.100092e0
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.1000b160
lea eax, [ebp - 0x254]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10006330
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x100062fb

Function at 0x100064b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_EnumWindows]
push esi
push edi
mov edi, dword [ebp + 8]
mov byte [0x1004c540], 0
xor esi, esi
inc esi
cmp esi, 0x1e
jg 0x100064f0
push edi
push 0x10005250
call ebx
cmp byte [0x1004c540], 0
jne 0x100064f0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1004c540], 0
je 0x100064c8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10006500
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x194]
push eax
push 0x101
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x78], eax
cmp eax, 0xffffffff
je 0x10006594
push esi
lea esi, [edi + 0x40c0]
mov eax, 2
push str.127.0.0.1
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [edi + 0x40c4], eax
mov eax, 0xcee
add ax, word [edi + 0x4170]
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0x40c2], ax
push 0x10
push esi
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_connect]
pop esi
cmp eax, 0xffffffff
jne 0x100065ab
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000eb51
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.10006d80
test al, al
je 0x100065c8
push 0
push 4
push str.PING
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, edi
call fcn.1000b250
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop edi
call fcn.1000eb51
mov esp, ebp
pop ebp
ret
Function at 0x10006a20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a900
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
push str.QueryFullProcessImageNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi + 0x40d0]
lea esi, [edi + 0x40d0]
push dword [ecx + 4]
mov ecx, esi
call fcn.100083c0
mov eax, dword [esi]
mov dword [ebp - 0x2c], 7
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], 0
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
xor eax, eax
mov dword [esi + 4], 0
mov dword [ebp - 0x26c], 0x22c
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
push eax
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x10006b1f
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x10006b1f
jmp 0x10006b00
push dword [ebp - 0x264]
mov ecx, edi
call fcn.100050b0
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x10006b00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb51
mov esp, ebp
pop ebp
ret

Function at 0x10006d80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_closesocket]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x78], eax
lea esi, [edi + 0x40c0]
mov eax, 2
push str.127.0.0.1
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [edi + 0x40c4], eax
mov eax, 0xcee
add ax, word [edi + 0x4170]
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0x40c2], ax
push 0x10
push esi
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
pop edi
setne al
pop esi
ret
Function at 0x10007600
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a9c8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push edi
mov word [ecx], ax
call fcn.100091c0
lea eax, [ebp - 0x40]
push eax
call fcn.1000bae0
add esp, 0x1c
mov esi, eax
push 5
push str.SCAN
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100090c0
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 1
call fcn.10001070
add esp, 0xc
cmp dword [ebp - 0x14], 0x10
jb 0x100076ad
push dword [ebp - 0x28]
call fcn.1000c91a
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp dword [ebp - 0x2c], 0x10
mov byte [ebp - 4], 4
jb 0x100076d4
push dword [ebp - 0x40]
call fcn.1000c91a
add esp, 4
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jb 0x100076f0
mov eax, dword [edi]
jmp 0x100076f2
mov eax, edi
push 0
push 0x80
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10007785
lea eax, [ebp - 0x5c]
push eax
push esi
mov dword [ebp - 0x5c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x80000
ja 0x10007766
cmp dword [ebp - 0x5c], 0
jne 0x10007766
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
mov ecx, ebx
call fcn.1000b970
test al, al
je 0x1000777c
mov ecx, ebx
mov byte [ebx + 0x415c], 1
call fcn.1000b250
push esi
mov byte [ebx + 0x415c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000779b
push 4
push str.:_OK
mov ecx, edi
call fcn.10008e60
push edi
mov ecx, ebx
call fcn.100077d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000779b
push 4
push str.:_OK
mov ecx, edi
call fcn.10008e60
push edi
mov ecx, ebx
call fcn.100077d0
cmp dword [ebp - 0x44], 0x10
jb 0x100077ac
push dword [ebp - 0x58]
call fcn.1000c91a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb51
mov esp, ebp
pop ebp
ret 4
Function at 0x100079d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
push 0x44
lea eax, [ebx + 0x40e0]
push 0
push eax
mov dword [ebp - 0xc], ebx
call fcn.1000f6d0
push 0x1006a88c
call fcn.1000c6d5
add esp, 0x10
test eax, eax
je 0x10007a08
push eax
call fcn.1000c731
add esp, 4
lea ecx, [ebx + 0x407c]
mov byte [ebx + 0x40dd], 0
mov byte [ebx + 0x40da], 0
mov byte [ebx + 0x29], 0
call fcn.100089e0
push dword [ebp + 8]
lea eax, [ebp - 1]
push eax
mov dword [ebx + 0x40a4], 0
mov dword [ebx + 0x416c], 0
push dword [ebx + 0x4134]
push dword [ebx + 0x4130]
call fcn.10001610
mov eax, dword [ebx + 0x4130]
push dword [ebp + 8]
mov dword [ebx + 0x4134], eax
lea esi, [ebx + 0x413c]
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
mov dword [ebp - 8], esi
push dword [esi]
call fcn.10001610
mov eax, dword [esi]
mov dword [esi + 4], eax
mov esi, dword [ebp + 8]
mov byte [ebx + 0x40dc], 1
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add esp, 0x20
xor edi, edi
add eax, edx
je 0x10007ad9
xor esi, esi
mov ecx, dword [ebp - 8]
lea eax, [esi + ebx]
push eax
call fcn.1000b160
mov eax, dword [ebp + 8]
inc edi
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea esi, [esi + 0x18]
cmp edi, ecx
jb 0x10007aa7
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
mov esi, dword [ebp - 0xc]
mov eax, 0x2aaaaaab
imul ecx
push 0
push 0
sar edx, 2
push esi
mov eax, edx
push 0x10009bf0
shr eax, 0x1f
add eax, edx
push 0
push 0
mov dword [esi + 0x40fc], eax
call fcn.1000e103
push 0x1006a88c
mov dword [esi + 0x416c], eax
call fcn.1000c6e6
add esp, 0x1c
pop edi
pop esi
pop ebx
test eax, eax
je 0x10007b2e
push eax
call fcn.1000c731
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x10007b40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 0x44
lea eax, [esi + 0x40e0]
push 0
push eax
mov dword [ebp - 0xc], esi
call fcn.1000f6d0
push 0x1006a88c
call fcn.1000c6d5
add esp, 0x10
test eax, eax
je 0x10007b78
push eax
call fcn.1000c731
add esp, 4
lea ecx, [esi + 0x407c]
mov byte [esi + 0x40dd], 0
mov byte [esi + 0x40da], 0
mov byte [esi + 0x29], 0
call fcn.100089e0
push dword [ebp + 8]
lea ebx, [esi + 0x4130]
lea eax, [ebp - 1]
push eax
mov dword [esi + 0x40a4], 0
mov dword [esi + 0x416c], 0
push dword [ebx + 4]
mov dword [ebp - 8], ebx
push dword [ebx]
call fcn.10001610
mov eax, dword [ebx]
push dword [ebp + 8]
mov dword [ebx + 4], eax
lea eax, [ebp - 1]
push eax
push dword [esi + 0x4140]
push dword [esi + 0x413c]
call fcn.10001610
mov eax, dword [esi + 0x413c]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x4140], eax
mov byte [esi + 0x40dc], 1
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add esp, 0x20
xor edi, edi
add eax, edx
je 0x10007c49
xor esi, esi
mov ecx, dword [ebp - 8]
lea eax, [esi + ebx]
push eax
call fcn.1000b160
mov eax, dword [ebp + 8]
inc edi
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea esi, [esi + 0x18]
cmp edi, eax
jb 0x10007c17
mov esi, dword [ebp - 0xc]
push 0
push 0
push esi
push 0x10009bf0
push 0
push 0
call fcn.1000e103
push 0x1006a88c
mov dword [esi + 0x416c], eax
call fcn.1000c6e6
add esp, 0x1c
pop edi
pop esi
pop ebx
test eax, eax
je 0x10007c7f
push eax
call fcn.1000c731
add esp, 4
mov esp, ebp
pop ebp
ret 4

Function at 0x10007eb0
Capabilities:
Check if file exists
Check mutex on windows
Create thread

Disassembly:
cmp byte [0x1004c542], 0
push esi
mov esi, ecx
je 0x10007f39
push str.UpdTm
push 0x5a0
call fcn.100041f0
test eax, eax
je 0x10007f39
push 0x5a0
mov ecx, esi
call fcn.100048d0
test eax, eax
je 0x10007f39
push str.GlobalPCAProMutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x10007efe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10007f39
cmp dword [0x1004c54c], 0
je 0x10007f1e
mov eax, dword [0x1004c54c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push esi
push 0x1000a380
push 0
push 0
call fcn.1000e103
add esp, 0x18
mov dword [0x1004c54c], eax
pop esi
ret
Function at 0x10021cd4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10010d1b
mov dword [ebp - 0x14], eax
cmp dword [0x1006b86c], edi
jne 0x10021dc5
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10021d52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10021ea5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10021ea5
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10021ea5
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1006b86c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x1006b870], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x1006b874], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1006b87c], eax
test eax, eax
je 0x10021dc2
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1006b878], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10021dea
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10021ddd
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10021dff
push 4
pop eax
jmp 0x10021ea7
cmp dword [ebp - 0x14], edi
je 0x10021dff
push dword [0x1006b86c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10021de4
mov eax, dword [0x1006b878]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x10021e5d
cmp dword [0x1006b87c], esi
je 0x10021e5d
push eax
call ebx
push dword [0x1006b87c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10021e5d
test eax, eax
je 0x10021e5d
call ecx
test eax, eax
je 0x10021e52
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10021e52
test byte [ebp - 8], 1
jne 0x10021e5d
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10021e8d
mov eax, dword [0x1006b870]
cmp eax, esi
je 0x10021e8a
push eax
call ebx
test eax, eax
je 0x10021e8a
call eax
mov edi, eax
test edi, edi
je 0x10021e8a
mov eax, dword [0x1006b874]
cmp eax, esi
je 0x10021e8a
push eax
call ebx
test eax, eax
je 0x10021e8a
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1006b86c]
call ebx
test eax, eax
je 0x10021ea5
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10021ea7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000eb51
leave
ret
Function at 0x100265c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10012c10
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x100265fc
xor eax, eax
jmp 0x10026628
cmp esi, dword [ebp - 4]
je 0x10026625
cmp dword [ebp + 0xc], 0
je 0x10026625
push dword [edi + 0x9c]
call fcn.100261d2
push dword [edi + 0x9c]
mov esi, eax
call fcn.10021bbd
pop ecx
pop ecx
cmp esi, eax
je 0x100265f8
xor eax, eax
inc eax
pop edi
pop esi
leave
ret