joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100085c7
Capabilities:
Get file version info

Disassembly:
push 0x230
mov eax, 0x1007bb46
call fcn.10063f27
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x23c], ebx
call fcn.10002a02
mov dword [ebp - 4], ebx
xor eax, eax
mov word [ebp - 0x218], ax
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [0x100aa3e8]
xor esi, esi
inc esi
mov dword [ebp - 0x23c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x22c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x21c], eax
call edi
cmp eax, ebx
jne 0x1000879b
cmp dword [ebp - 0x21c], ebx
jbe 0x1000879b
push dword [ebp - 0x21c]
call fcn.10059bd9
pop ecx
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], eax
push dword [ebp - 0x22c]
lea eax, [ebp - 0x218]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10008787
call edi
test eax, eax
jne 0x10008787
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x234]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x220]
mov dword [ebp - 0x224], ebx
call sub.VERSION.dll_VerQueryValueW
xor edi, edi
test dword [ebp - 0x224], 0xfffffffc
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x238], ebx
jbe 0x10008787
mov eax, dword [0x100aa3bc]
mov ecx, 0x100aa3bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x234]
lea eax, [eax + edi*4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str.StringFileInfo_04x_04xFileVersion
lea eax, [ebp - 0x21c]
call fcn.100027be
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10008751
push dword [ebp - 0x230]
push dword [ebp - 0x228]
call fcn.100027a0
mov eax, dword [ebp - 0x228]
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
jne 0x10008776
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.100029ea
mov eax, dword [ebp - 0x224]
inc edi
shr eax, 2
cmp edi, eax
jb 0x100086d2
jmp 0x10008787
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.100029ea
cmp dword [ebp - 0x220], ebx
je 0x1000879b
push dword [ebp - 0x220]
call fcn.1005a1d0
pop ecx
mov eax, dword [ebp - 0x228]
call fcn.10063faa
ret
Function at 0x10009f7b
Capabilities:
Create thread

Disassembly:
xor edx, edx
cmp dword [ecx + 0x28], edx
jbe 0x10009f90
mov eax, dword [ecx + 0x24]
mov eax, dword [eax]
cmp eax, edx
je 0x10009f90
jmp fcn.1000979d
mov byte [ecx + 0x34], dl
ret

Function at 0x10009f94
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x1007d639
call fcn.10063ebe
mov ebx, ecx
mov eax, dword [ebx + 8]
cmp eax, 2
sete al
test al, al
je 0x1000a09c
lea esi, [ebp - 0x14]
mov eax, ebx
call fcn.10009bbd
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x10093438
push ecx
mov ecx, eax
call fcn.10002388
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ecx
pop ecx
push dword [eax]
call esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.100029ea
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.100029ea
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.10009c09
lea ecx, [ebp - 0x18]
push 0x10093440
push ecx
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10002388
pop ecx
pop ecx
push dword [eax]
call esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.100029ea
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.100029ea
mov dword [edi + 0x3c], 0x1e
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x1000a06f
dec eax
jne 0x1000a06f
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, ebx
call fcn.10009c09
mov dword [ebp - 4], 2
call fcn.1001e712
or dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.1001eaef
cmp dword [edi + 0x28], 0
jbe 0x1000a105
lea esi, [edi + 0x24]
cmp dword [esi + 4], 0
ja 0x1000a08c
push 0x80070057
call fcn.10002a17
mov eax, dword [esi]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000a0f9
mov eax, dword [ecx]
push 1
call dword [eax]
jmp 0x1000a0f9
xor esi, esi
cmp dword [edi + 0x3c], 0x5a
ja 0x1000a0dc
cmp dword [ebx + 0x10], esi
je 0x1000a0dc
mov eax, dword [edi + 0x38]
cmp eax, esi
je 0x1000a0bd
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [edi + 0x38], esi
mov eax, dword [edi + 0x3c]
imul eax, eax, 0x3e8
push esi
push eax
push 0xa
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
add dword [edi + 0x3c], 0x1e
mov dword [edi + 0x38], eax
jmp 0x1000a105
cmp dword [edi + 0x28], esi
jbe 0x1000a105
lea ebx, [edi + 0x24]
cmp dword [ebx + 4], esi
jbe 0x1000a082
mov eax, dword [ebx]
mov ecx, dword [eax]
cmp ecx, esi
je 0x1000a0f7
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, ebx
call fcn.1000a4ed
mov ecx, edi
call fcn.10009f7b
call fcn.10063f96
ret
Function at 0x1000a42f
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100a82b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setge byte [ebp - 0x20d]
cmp byte [ebp - 0x20d], bl
je 0x1000a4d8
push esi
push 0x100935cc
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1005ab1d
add esp, 0xc
lea eax, [ebp - 0x20c]
cmp byte [ebp + 8], bl
je 0x1000a4a1
push str.EDCBC0BF_44ED_466F_AF2F_47802E05BDE6
jmp 0x1000a4a6
push str.CB9BD22F_6363_4203_A5D1_F26473612CEE
push esi
push eax
call fcn.1005ab1d
lea eax, [ebp - 0x20c]
add esp, 0xc
push eax
call fcn.100076fd
pop ecx
pop esi
test al, al
je 0x1000a4d8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne byte [ebp - 0x20d]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
xor ecx, ebp
pop ebx
call fcn.10059ccb
leave
ret 4

Function at 0x1000a9b3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea ebx, [edi + 0xc]
push ebx
push str.VBScript
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
lea esi, [edi + 0x24]
push esi
push 0x10096b90
push 1
push 0
push ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
jge 0x1000a9f1
push str.Failed_to_create_scripting_engine._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebx
jmp 0x1000aa51
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi]
mov ecx, dword [eax]
lea ebx, [edi + 0x28]
push ebx
push 0x10096ba0
push eax
call dword [ecx]
mov dword [ebp - 4], eax
test eax, eax
jge 0x1000aa20
push str.Engine_doesnt_support_IActiveScriptParse._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 4]
jmp 0x1000aa51
mov esi, dword [esi]
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0xc]
mov esi, eax
test esi, esi
jge 0x1000aa36
push str.Error_calling_SetScriptSite_n
jmp 0x1000aa49
mov ebx, dword [ebx]
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
mov esi, eax
test esi, esi
jge 0x1000aa51
push str.Error_calling_InitNew_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1000aa55
Capabilities:
Print debug messages

Disassembly:
push 0
mov eax, 0x1007b2c3
call fcn.10063ebe
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
jne 0x1000aa76
xor ebx, ebx
inc ebx
jmp 0x1000ab00
lea eax, [esi + 0x20]
push eax
call fcn.1000ad47
mov ebx, eax
cmp ebx, edi
jl 0x1000ab00
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
push 6
push 0x10093318
push eax
call dword [ecx + 0x20]
mov ebx, eax
cmp ebx, edi
jl 0x1000ab00
mov eax, dword [ebp + 8]
push dword [eax - 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
cmp eax, edi
jne 0x1000aaba
call fcn.10002946
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push ecx
call dword [edx + 0x14]
mov ebx, eax
cmp ebx, edi
jge 0x1000aadf
push str.Error_calling_ParseScriptText_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000ab00
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x14]
mov ebx, eax
cmp ebx, edi
jge 0x1000aaf7
push str.Error_calling_SetScriptState_n
jmp 0x1000aad7
mov eax, dword [esi + 0x20]
mov al, byte [eax + 8]
mov byte [esi + 0x2c], al
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.100029ea
mov eax, ebx
call fcn.10063f96
ret 4
Function at 0x1000bc96
Capabilities:
Hide graphical window
Log keystrokes via application hook

Disassembly:
push 0x20
mov eax, 0x1007f6db
call fcn.10063ebe
call fcn.1000eb6e
call fcn.1000ed3c
cmp eax, 4
je 0x1000be65
cmp eax, 1
je 0x1000bcea
cmp eax, 2
je 0x1000bcea
cmp eax, 6
je 0x1000bcea
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.1000eb6e
mov esi, eax
call fcn.10029e0c
call fcn.1000eb6e
call fcn.100116b9
jmp 0x1000be65
mov cl, byte [edi + 0x24]
test cl, cl
jne 0x1000be6e
cmp eax, 1
sete byte [ebp - 0xd]
mov byte [edi + 0x24], 1
cmp byte [ebp - 0xd], cl
je 0x1000bd0f
call fcn.1000eb6e
call fcn.10011811
lea eax, [ebp - 0x2c]
push str.Msg_ConfirmCancelTitle
push eax
call fcn.1001419c
push eax
call fcn.100144ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push str.Msg_ConfirmCancelText
push eax
call fcn.1001419c
push eax
call fcn.100144ef
mov byte [ebp - 4], 1
call fcn.1000eb6e
mov esi, eax
call fcn.1000ebc9
lea esi, [ebp - 0x1c]
mov ebx, eax
call fcn.10027571
mov byte [ebp - 4], 2
test ebx, ebx
je 0x1000bd68
lea eax, [ebx + 0xf0]
call fcn.10027881
call fcn.1000eb6e
call fcn.1000ebdd
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x2c]
call fcn.10027ada
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x24]
call fcn.10027ada
call fcn.1000eb6e
mov dword [eax + 0x43c], 2
mov eax, dword [edi + 4]
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x1000e7db
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0x41
push esi
push ebx
push dword [ebp - 0x14]
mov dword [0x100aaf98], eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x1000be19
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.1000eb6e
mov esi, eax
call fcn.10029e0c
call fcn.1000eb6e
mov esi, eax
call fcn.1000ebc9
test eax, eax
je 0x1000be03
mov dword [eax + 0x170], 2
call fcn.1000eb6e
call fcn.1000ebdd
call fcn.1000eb6e
call fcn.100116b9
jmp 0x1000be29
cmp byte [ebp - 0xd], 0
je 0x1000be29
call fcn.1000eb6e
call fcn.10011850
xor esi, esi
mov byte [ebp - 4], 1
mov byte [edi + 0x24], 0
cmp dword [ebp - 0x1c], esi
je 0x1000be41
push dword [ebp - 0x1c]
call fcn.1005a1d0
pop ecx
mov byte [ebp - 4], 0
cmp dword [ebp - 0x24], esi
je 0x1000be53
push dword [ebp - 0x24]
call fcn.1005a1d0
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], esi
je 0x1000be65
push dword [ebp - 0x2c]
call fcn.1005a1d0
pop ecx
mov eax, dword [ebp + 8]
mov dword [eax], 1
xor eax, eax
call fcn.10063f96
ret 4
Function at 0x1000c187
Capabilities:
Create process on windows

Disassembly:
push 0x2c
mov eax, 0x1007c98e
call fcn.10063ebe
mov eax, dword [ebp + 8]
mov esi, ecx
push 0x3ee
push dword [esi + 4]
movsx edi, ax
shr eax, 0x10
movsx ebx, ax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x38]
jl 0x1000c242
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x34]
jl 0x1000c242
cmp eax, dword [ebp - 0x30]
jg 0x1000c242
cmp ecx, dword [ebp - 0x2c]
jg 0x1000c242
push 0x7f89
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.10029b21
test al, al
je 0x1000c254
lea eax, [ebp - 0x18]
push 0x10092ea4
push eax
call fcn.1001419c
push eax
call fcn.100144ef
mov dword [ebp - 4], esi
push dword [eax]
call fcn.10028d83
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
inc bl
pop ecx
cmp dword [ebp - 0x18], esi
je 0x1000c23e
push dword [ebp - 0x18]
call fcn.1005a1d0
pop ecx
test bl, bl
jne 0x1000c24a
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
call fcn.10063f96
ret 8
lea eax, [ebp - 0x28]
push str.Msg_HelpUrl
push eax
call fcn.1001419c
push eax
call fcn.100144ef
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
mov edi, eax
call fcn.100022a8
mov byte [ebp - 4], 3
cmp dword [ebp - 0x28], esi
je 0x1000c28d
push dword [ebp - 0x28]
call fcn.1005a1d0
pop ecx
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x14], esp
mov edi, esp
call fcn.1000296d
add eax, 0x10
mov dword [edi], eax
call fcn.10007090
pop ecx
test al, al
je 0x1000c2bf
push ebx
push esi
push esi
push dword [ebp + 8]
push 0x10092dd4
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.100029ea
jmp 0x1000c245
Function at 0x1000c8e5
Capabilities:
Create thread

Disassembly:
push 0x18
mov eax, 0x1007eebc
call fcn.10063ebe
call fcn.1000eb6e
call fcn.1000ed3c
mov esi, eax
cmp esi, 3
jne 0x1000c92c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000cac4
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x1000cac4
call fcn.1000eb6e
call fcn.1000ed3c
cmp eax, 5
sete bl
call fcn.1000d3dc
mov byte [ebp - 0x11], al
test bl, bl
jne 0x1000c951
test al, al
je 0x1000c951
cmp byte [ebp + 8], bl
je 0x1000c97a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000c972
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test bl, bl
jne 0x1000cac4
cmp byte [ebp - 0x11], 0
je 0x1000cac4
cmp esi, 4
je 0x1000cac4
push 4
call fcn.1000eb6e
mov esi, eax
call fcn.1000ed5f
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetSystemMenu]
test eax, eax
je 0x1000c9b8
push 3
push 0xf060
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
lea eax, [ebp - 0x1c]
push str.Msg_Installing
push eax
call fcn.1001419c
push eax
call fcn.100144ef
and dword [ebp - 4], 0
lea esi, [ebp - 0x24]
call fcn.10027571
mov byte [ebp - 4], 1
call fcn.1000eb6e
mov esi, eax
call fcn.1000ebc9
test eax, eax
je 0x1000c9f9
add eax, 0xf0
lea esi, [ebp - 0x24]
call fcn.10027881
call fcn.1000eb6e
call fcn.1000ebdd
lea eax, [ebp - 0x24]
push eax
lea ebx, [ebp - 0x1c]
call fcn.10027ada
push dword [ebp - 0x1c]
push edi
call fcn.1000d4b6
push ecx
push ecx
mov eax, ebx
mov esi, esp
mov dword [ebp + 8], esp
push eax
call fcn.10027600
mov byte [ebp - 4], 2
call fcn.1000eb6e
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10011bad
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3e9
push dword [edi + 4]
call esi
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 8
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x32
push 1
push 0x40a
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3ef
push dword [edi + 4]
call esi
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.1000eb6e
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push 0x1000ed85
push ebx
push ebx
call fcn.1005b758
add esp, 0x18
mov byte [ebp - 4], bl
cmp dword [ebp - 0x24], ebx
je 0x1000cab2
push dword [ebp - 0x24]
call fcn.1005a1d0
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], ebx
je 0x1000cac4
push dword [ebp - 0x1c]
call fcn.1005a1d0
pop ecx
call fcn.10063f96
ret 4
Function at 0x1000d747
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000d7ab
cmp dword [ebp + 0xc], 1
je 0x1000d783
cmp dword [ebp + 0xc], 2
je 0x1000d783
push 0xd
pop eax
jmp 0x1000d7ab
mov eax, dword [ebp - 4]
test edi, edi
je 0x1000d7a5
test eax, eax
je 0x1000d7a0
test al, 1
jne 0x1000d77e
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x1000d7a5
jmp 0x1000d77e
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x1000e00a
Capabilities:
Check mutex on windows

Disassembly:
push 0x10092bd8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1000e037
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000e037
push 0x3e8
push dword [esi + 4]
jmp 0x1000e058
cmp dword [esi + 4], 0
jne 0x1000e05e
push str.Global223CEB62_A2BC_4E33_BA9B_FCAC6DAAB1BE
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
push 0x3e8
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x100136db
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call sym.OCSetupHlp.dll_OCPRD124GetNoCandy
test eax, eax
jne 0x100137b1
mov eax, dword [0x100aa3bc]
mov ecx, 0x100aa3bc
call dword [eax + 0xc]
mov ebx, dword [ebp + 0x10]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push ebx
push eax
call fcn.10006f91
push dword [eax]
lea eax, [ebp - 4]
push str.SDK_Display_called:_lpszCmdLine:_s
call fcn.100027be
mov eax, dword [ebp + 0x10]
add esp, 0x10
add eax, 0xfffffff0
call fcn.100029ea
mov edi, dword [ebp - 4]
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [ebp + 0x10], esp
mov esi, esp
call fcn.1000296d
add eax, 0x10
mov dword [esi], eax
call fcn.1001bbf7
mov ecx, eax
call fcn.1001d984
push 0x1000
call fcn.10059bd9
mov esi, eax
push esi
push 0x800
push ebx
call fcn.1002a5a3
push 7
push 0x10090da0
push ebx
call fcn.1005b8fa
add esp, 0x1c
test eax, eax
je 0x10013790
push 8
push 0x10090d4c
push ebx
call fcn.1005b8fa
add esp, 0xc
test eax, eax
jne 0x100137a3
push 1
xor eax, eax
push eax
push eax
push esi
push 0x10090da8
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call fcn.1005a1d0
pop ecx
mov eax, edi
call fcn.100029ea
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10016408
Capabilities:
Check mutex on windows

Disassembly:
push 0x10
mov eax, 0x1007d8fb
call fcn.10063ebe
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0x1008b2b0
xor ebx, ebx
inc ebx
push ebx
xor esi, esi
push esi
call edi
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x100164d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100164c6
push esi
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov edi, 0x1008b330
call fcn.100022a8
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
mov edi, str.AlreadyRunningDLMgr_error
mov dword [ebp - 4], esi
call fcn.100022a8
push dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
call fcn.1001a3fb
lea eax, [ebp - 0x10]
push eax
mov edi, str.ERROR:_DLMgr_detected_as_already_runnning.
call fcn.100022a8
push esi
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
push ebx
push ecx
add eax, 0xfffffff0
mov dword [ebp + 8], esp
mov edi, esp
call fcn.1000296d
add eax, 0x10
mov dword [edi], eax
push ebx
push esi
push ecx
mov byte [ebp - 4], 2
call fcn.10016053
pop ecx
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.1001ae54
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.100029ea
mov al, bl
jmp 0x1001650c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.GlobalOCMGR41114DCBA1154DECBD3F7DE1891F3E70
push ebx
push esi
call edi
mov edi, eax
cmp edi, esi
je 0x1001650a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x100164c2
call esi
test eax, eax
jne 0x1001650a
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.10063f96
ret 4
Function at 0x10018d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007e29b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x100a82b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, edi
call fcn.10016587
mov dword [esp + 0x14], eax
mov eax, dword [0x100aa3bc]
mov ecx, 0x100aa3bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
and dword [esp + 0x30], 0
mov ebx, dword [0x100aa3e8]
mov eax, 0x104
push eax
push eax
lea esi, [esp + 0x14]
call fcn.100028e3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1000292d
push 0x1008d190
mov eax, esi
push eax
call fcn.100040d1
push 0x1008d194
mov eax, esi
push eax
call fcn.100040d1
mov eax, dword [esp + 0xc]
push 0xfde9
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
mov dword [esp + 0x20], eax
call fcn.1000296d
add eax, 0x10
mov dword [esi], eax
call fcn.10006dfa
pop ecx
pop ecx
push eax
lea esi, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.10026f71
mov byte [esp + 0x30], 1
mov eax, dword [edi + 0x134]
mov cl, byte [edi]
test eax, eax
je 0x10018e66
mov byte [eax + 0x41], cl
mov ebx, dword [esp + 0x14]
mov eax, ebx
call fcn.1001f382
mov dword [esp + 0x14], eax
test eax, eax
je 0x10018eb0
test cl, cl
je 0x10018ea6
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x10018e95
mov eax, dword [eax]
push dword [esp + 0x1c]
lea esi, [eax + 0xe0]
call fcn.10027362
push ebx
mov ebx, dword [esp + 0x18]
call fcn.100202f8
push 1
push 8
push ebx
jmp 0x10018eab
push 1
push 3
push eax
call fcn.10020c3d
cmp dword [esp + 0x10], 0
je 0x10018ec1
push dword [esp + 0x10]
call fcn.1005a1d0
pop ecx
mov eax, edi
call fcn.10016598
mov byte [esp + 0x30], 0
cmp dword [esp + 0x1c], 0
je 0x10018ede
push dword [esp + 0x1c]
call fcn.1005a1d0
pop ecx
mov eax, dword [esp + 0x18]
call fcn.100029ea
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019a12
Capabilities:
Check mutex on windows

Disassembly:
push 0xc
mov eax, 0x1007f6a8
call fcn.10063ebe
mov esi, ecx
mov eax, dword [esi + 0x13c]
xor ebx, ebx
cmp eax, ebx
je 0x10019a96
cmp dword [eax + 0x18], 0xd
jge 0x10019a86
push 0x1008d6d0
inc ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov edi, eax
test edi, edi
je 0x10019a5d
push 0x7530
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.100165fc
call fcn.10025a29
call fcn.1000eb6e
mov edx, dword [esi + 0x13c]
mov ecx, eax
call fcn.10011c11
and dword [esi + 0x13c], 0
jmp 0x10019b17
cmp eax, ebx
je 0x10019a96
push eax
call fcn.1000eb53
mov dword [esi + 0x13c], ebx
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov edi, 0x1008d5d8
call fcn.100022a8
push ecx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
mov edi, str.DownloadMgr2RecycleOffer_m_pScheduledOffer_is_not_valid
call fcn.100022a8
or dword [ebp - 4], 0xffffffff
push esi
call fcn.1001a3fb
lea eax, [ebp - 0x10]
push eax
mov edi, str.ERROR:_DownloadMgr2RecycleOffer_m_pScheduledOffer_is_not_valid.
call fcn.100022a8
xor ebx, ebx
inc ebx
push 0
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
push ebx
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.1000296d
add eax, 0x10
mov dword [esi], eax
push ebx
push 0
push ecx
mov byte [ebp - 4], 2
call fcn.10016053
pop ecx
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.1001ae54
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.100029ea
call fcn.10063f96
ret