joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100037f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1001c460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x3f
lea ecx, [ebp - 0x83]
push 0
push ecx
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x84], 0
call fcn.1000c490
push 0x3f
lea edx, [ebp - 0x43]
push 0
push edx
mov byte [ebp - 0x44], 0
call fcn.1000c490
add esp, 0x18
xor esi, esi
jmp 0x10003840
mov ecx, dword [0x1001e72c]
mov edx, dword [ecx + 0x24]
lea eax, [ebp - 0x88]
push eax
push 9
push 0
push str.SOFTWARESecuritySvc
mov edi, 0x104
push connect
mov dword [ebp - 0x8c], edi
call edx
test eax, eax
jne 0x10003907
mov edx, dword [ebp - 0x88]
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x44]
push ecx
push esi
push edx
mov dword [ebp - 0x8c], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, dword [0x1001e72c]
mov edx, dword [ecx + 0x18]
test eax, eax
mov eax, dword [ebp - 0x88]
push eax
jne 0x10003905
call edx
push 0
lea eax, [ebp - 0x44]
push eax
push str.SOFTWARESecuritySvc
mov ecx, 1
lea edx, [ebp - 0x84]
call fcn.10006020
mov ecx, dword [ebp - 0x90]
add esp, 0xc
push ecx
lea edx, [ebp - 0x84]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100038e9
cmp edi, 1
je 0x10003919
inc esi
xor eax, eax
cmp esi, 0x19
jb 0x10003840
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000680f
mov esp, ebp
pop ebp
ret
call edx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000680f
mov esp, ebp
pop ebp
ret
push 1
lea eax, [ebp - 0x44]
push eax
push str.SOFTWARESecuritySvc
mov ecx, 1
mov edx, str.idle
call fcn.10006020
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
xor ecx, ebp
pop esi
call fcn.1000680f
mov esp, ebp
pop ebp
ret
Function at 0x10004590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1001a838
push 0x1000b9f0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x102c
call fcn.10010580
mov eax, dword [0x1001c460]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1044], eax
mov byte [ebp - 0x1035], 0
xor ebx, ebx
mov dword [ebp - 0x1040], ebx
mov esi, dword [ebp - 0x103c]
mov eax, dword [ebx*4 + 0x1001d30c]
test eax, eax
je 0x10004754
mov dword [ebp - 4], 0
push eax
push str.GET___HTTP_1.1_r_nHOST:_s_r_n_r_n
lea ecx, [ebp - 0x1024]
push ecx
call fcn.1000747f
add esp, 0xc
mov eax, dword [ebx*4 + 0x1001d30c]
inc ebx
mov dword [ebp - 0x1040], ebx
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x10004725
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [ebp - 0x103c], esi
cmp esi, 0xffffffff
je 0x10004725
mov edx, 2
mov word [ebp - 0x1034], dx
push 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1032], ax
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [ebp - 0x1030], edx
push 0x10
lea eax, [ebp - 0x1034]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10004725
push 0
push 0x1000
lea ecx, [ebp - 0x1024]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10004725
push 0x1000
push 0
lea edx, [ebp - 0x1024]
push edx
call fcn.1000c490
add esp, 0xc
push 0
push 0x1000
lea eax, [ebp - 0x1024]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x10004725
push str.Date:
lea ecx, [ebp - 0x1024]
push ecx
call fcn.10007880
add esp, 8
test eax, eax
je 0x10004725
lea esi, [eax + 6]
mov ecx, 7
mov edi, dword [ebp - 0x1044]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov bl, 1
mov byte [ebp - 0x1035], bl
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x1001c460
call fcn.1000e5c0
add esp, 0xc
mov al, bl
jmp 0x1000475a
mov dword [ebp - 4], 0xfffffffe
call fcn.10004742
jmp 0x100045eb
mov al, byte [ebp - 0x1035]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1000680f
mov esp, ebp
pop ebp
ret
Function at 0x10004cb0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push ebx
push 1
push ebx
push str.gotowin.EncryptDecrypt.Simple
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call edi
test eax, eax
jne 0x10004d03
push 8
push 1
push ebx
push str.gotowin.EncryptDecrypt.Simple
lea ecx, [ebp - 8]
push ecx
call edi
test eax, eax
je 0x10004e3c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push ebx
push ebx
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10004e3c
mov edx, dword [ebp + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004d28
mov ecx, dword [ebp - 4]
push ebx
sub eax, edi
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10004e3c
mov ecx, dword [ebp - 4]
push ebx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 4
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x10004e3c
mov eax, dword [ebp - 0xc]
push 4
push 0x1000
push eax
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp - 0x14]
push edx
mov edi, eax
push ebx
push edi
call fcn.1000c490
add esp, 0xc
mov dword [ebp - 0x14], edi
cmp edi, ebx
je 0x10004e50
mov ecx, dword [ebp - 4]
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x10004e3c
movzx eax, byte [edi + 7]
cdq
add dword [esi], eax
movzx eax, byte [edi + 6]
adc dword [esi + 4], edx
cdq
shld edx, eax, 8
shl eax, 8
add dword [esi], eax
movzx eax, byte [edi + 5]
adc dword [esi + 4], edx
cdq
shld edx, eax, 0x10
shl eax, 0x10
add dword [esi], eax
movzx eax, byte [edi + 4]
adc dword [esi + 4], edx
cdq
shld edx, eax, 0x18
shl eax, 0x18
add dword [esi], eax
movzx eax, byte [edi + 3]
adc dword [esi + 4], edx
add dword [esi], ebx
cdq
adc dword [esi + 4], eax
movzx eax, byte [edi + 2]
cdq
shl eax, 8
add dword [esi], ebx
adc dword [esi + 4], eax
movzx eax, byte [edi + 1]
cdq
shl eax, 0x10
add dword [esi], ebx
adc dword [esi + 4], eax
movzx eax, byte [edi]
cdq
shl eax, 0x18
add dword [esi], ebx
adc dword [esi + 4], eax
add edi, 0xf
lea ecx, [ecx]
movzx eax, byte [edi]
cdq
mov ecx, ebx
call fcn.10011510
add dword [esi + 8], eax
adc dword [esi + 0xc], edx
add ebx, 8
dec edi
cmp ebx, 0x40
jl 0x10004e20
xor ebx, ebx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x10004e50
push 0x8000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10004e5e
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x10004e6d
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005130
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1001a8b8
push 0x1000b9f0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1001c460]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 4], edi
push edi
push 0x80
push 3
push edi
push 1
push connect
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 0xffffffff
je 0x10005229
push 2
push edi
push 0xfffffffffffffffc
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], edi
push edi
lea ecx, [ebp - 0x20]
push ecx
push 4
lea edx, [ebp - 0x1c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10005229
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x30]
jae 0x10005229
mov edi, eax
call fcn.100058c0
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x10005229
push 2
push 0
mov eax, 0xfffffffc
sub eax, dword [ebp - 0x1c]
push eax
push esi
call ebx
push 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10005229
mov eax, dword [ebp - 0x1c]
push eax
push edi
mov ecx, dword [ebp + 8]
push ecx
call fcn.10002610
add esp, 0xc
test eax, eax
je 0x10005229
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.10005250
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100052c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1001a978
push 0x1000b9f0
mov eax, dword fs:[0]
push eax
sub esp, 0x320
mov eax, dword [0x1001c460]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x32c], 0
mov byte [ebp - 0x328], 0
push 0x103
push 0
lea eax, [ebp - 0x327]
push eax
call fcn.1000c490
mov dword [ebp - 0x224], 0x67706a
push 0x100
push 0
lea ecx, [ebp - 0x220]
push ecx
call fcn.1000c490
mov dword [ebp - 0x120], 0x747874
push 0x100
push 0
lea edx, [ebp - 0x11c]
push edx
call fcn.1000c490
add esp, 0x24
mov dword [ebp - 4], 0
cmp ebx, 1
jne 0x10005385
lea eax, [ebp - 0x328]
push eax
mov ecx, esi
call fcn.10004f80
add esp, 4
test eax, eax
je 0x10005435
jmp 0x10005393
push esi
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x328]
call fcn.100059a0
add esp, 4
test al, al
je 0x10005435
lea esi, [ebp - 0x120]
call fcn.100058f0
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
push ecx
call fcn.10005130
add esp, 8
test eax, eax
je 0x10005435
push edi
mov edx, esi
push edx
call fcn.10004a30
add esp, 8
test eax, eax
jne 0x10005435
cmp ebx, 1
jne 0x1000542b
push 0x1001e734
call fcn.10007bcb
add esp, 4
mov esi, eax
push edi
push 0
push str.StartDate
push str.Date
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call ebx
mov dword [ebp - 0x330], eax
push edi
push 0
push str.ExpireDate
push str.Date
call ebx
cmp esi, dword [ebp - 0x330]
jl 0x10005435
cmp esi, eax
jg 0x10005435
mov dword [ebp - 0x32c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.10005463
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000680f
mov esp, ebp
pop ebp
ret
Function at 0x100057a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1001c460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.10007725
add esp, 4
push esi
call fcn.10007737
cdq
mov ecx, 0x1f4
idiv ecx
push edx
push 0x1001e768
lea edx, [ebp - 0x108]
push str._sNetCC_d._s
push edx
call fcn.1000747f
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 1
push connect
lea ecx, [ebp - 0x108]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x10005885
lea ebx, [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.10007737
cdq
mov ecx, 0x1f4
idiv ecx
push edx
push 0x1001e768
lea edx, [ebp - 0x108]
push str._sNetCC_d._s
push edx
call fcn.1000747f
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call edi
push 0
push 0
push 3
push 0
push 1
push connect
lea ecx, [ebp - 0x108]
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x10005830
mov esi, dword [ebp - 0x10c]
push 0x104
push 0
push esi
call fcn.1000c490
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000680f
mov esp, ebp
pop ebp
ret

Function at 0x100058f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x1001c460]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x10019b68
push esi
call fcn.10007880
add esp, 8
test eax, eax
je 0x1000594d
push esi
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0
lea edx, [ebp - 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000680f
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push esi
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea ecx, [ebp - 0x108]
call fcn.100057a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.1000680f
mov esp, ebp
pop ebp
ret
Function at 0x10005bf0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x1001c460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xff
xor edi, edi
lea eax, [ebp - 0x207]
push edi
push eax
mov byte [ebp - 0x208], 0
call fcn.1000c490
push 0x103
lea ecx, [ebp - 0x107]
push edi
push ecx
mov byte [ebp - 0x108], 0
call fcn.1000c490
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x18
push 0x1001e768
lea edx, [ebp - 0x208]
push edx
call ebx
lea eax, [ebp - 0x208]
push 0x10018778
push eax
call fcn.10007668
mov esi, eax
push esi
push 0x10019bb0
mov dword [ebp - 0x288], esi
call fcn.10007d34
add esp, 0x10
push esi
lea ecx, [ebp - 0x108]
push ecx
call ebx
test esi, esi
je 0x10005ced
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea esp, [esp]
push 0x10018778
push 0
inc edi
call fcn.10007668
mov esi, eax
push esi
push 0x10019bb0
call fcn.10007d34
add esp, 0x10
push 0x10018778
lea edx, [ebp - 0x108]
push edx
call ebx
push esi
lea eax, [ebp - 0x108]
push eax
call ebx
lea ecx, [ebp - 0x108]
push ecx
push edi
push str._d__s_n
call fcn.10007d34
add esp, 0xc
push 6
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test esi, esi
jne 0x10005c90
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000680f
mov esp, ebp
pop ebp
ret
Function at 0x10006210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1001c460]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x24]
mov dword [ebp - 0x24], 0x6c707865
mov dword [ebp - 0x20], 0x7265726f
mov dword [ebp - 0x1c], 0x6578652e
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
call fcn.10006160
push eax
mov eax, dword [0x1001e730]
mov ecx, dword [eax + 0x2c]
push 0
push 0x40
call ecx
mov esi, eax
test esi, esi
je 0x10006292
push 0
push 0x80
push 3
push 0
push 0
push connect
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x100062a4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000680f
mov esp, ebp
pop ebp
ret
mov edi, dword [0x1001e730]
push 3
push 0
push 0
lea edx, [ebp - 0x28]
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov eax, dword [edi + 0x64]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1000680f
mov esp, ebp
pop ebp
ret
Function at 0x100062e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1001a918
push 0x1000b9f0
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x1001c460]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 0x234], bl
push 0x103
push ebx
lea eax, [ebp - 0x233]
push eax
call fcn.1000c490
add esp, 0xc
mov byte [ebp - 0x33c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x33b]
push ecx
call fcn.1000c490
add esp, 0xc
mov byte [ebp - 0x12c], bl
push 0x103
push ebx
lea edx, [ebp - 0x12b]
push edx
call fcn.1000c490
add esp, 0xc
mov dword [ebp - 0x480], ebx
mov dword [ebp - 4], ebx
push esi
push str._s.
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x47c]
push ecx
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x480], edi
cmp edi, 0xffffffff
jne 0x100063c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 0xfffffffe
jmp 0x100064bd
mov ecx, 0x10019c58
lea eax, [ebp - 0x450]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100063f0
cmp dl, bl
je 0x100063ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100063f0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100063d0
xor eax, eax
jmp 0x100063f5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10006481
mov ecx, 0x10019c5c
lea eax, [ebp - 0x450]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10006428
cmp dl, bl
je 0x10006424
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10006428
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10006408
xor eax, eax
jmp 0x1000642d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10006481
lea eax, [ebp - 0x450]
push eax
push esi
push str._s_s
test byte [ebp - 0x47c], 0x10
je 0x10006465
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0x12c]
push edx
call fcn.100062e0
add esp, 0x14
jmp 0x10006481
lea ecx, [ebp - 0x33c]
push ecx
call fcn.1000747f
add esp, 0x10
lea ebx, [ebp - 0x33c]
call fcn.10006210
xor ebx, ebx
lea edx, [ebp - 0x47c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100063c1
mov dword [ebp - 4], 0xfffffffe
jmp 0x100064b6
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1000680f
mov esp, ebp
pop ebp
ret

Function at 0x1000680f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001c460]
jne 0x10006819
repz ret
jmp fcn.10009cda
Function at 0x1000fdec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001c460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000c8b2
and dword [ebp - 0x14], 0
cmp dword [0x1001e6d4], 0
mov dword [ebp - 0x18], eax
jne 0x1000fe9f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000ff47
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000ff47
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001e6d4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001e6d8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001e6dc], eax
call edi
push eax
call esi
mov dword [0x1001e6e4], eax
test eax, eax
je 0x1000fe9f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001e6e0], eax
mov eax, dword [0x1001e6e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000fef8
cmp dword [0x1001e6e4], ecx
je 0x1000fef8
push eax
call esi
push dword [0x1001e6e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000fef8
test ebx, ebx
je 0x1000fef8
call edi
test eax, eax
je 0x1000feef
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000feef
test byte [ebp - 8], 1
jne 0x1000fef8
or dword [ebp + 0x10], 0x200000
jmp 0x1000ff2b
mov eax, dword [0x1001e6d8]
cmp eax, dword [ebp - 0x18]
je 0x1000ff2b
push eax
call esi
test eax, eax
je 0x1000ff2b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000ff2b
mov eax, dword [0x1001e6dc]
cmp eax, dword [ebp - 0x18]
je 0x1000ff2b
push eax
call esi
test eax, eax
je 0x1000ff2b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001e6d4]
call esi
test eax, eax
je 0x1000ff47
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000ff49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000680f
leave
ret