joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100040a0
Capabilities:
Check for time delay via gettickcount
Connect to http server
Create http request
Delete file
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10156af8], 0
push ebx
push esi
push edi
je 0x100041c0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1014cb70]
cmp eax, 0x927c0
jb 0x100040df
call esi
mov dword [0x1014cb70], eax
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 1
push 0x10156b40
mov ebx, eax
movzx eax, word [0x10156b1c]
push 0x10156b20
push eax
push 0x10156afc
push ebx
call dword [sym.imp.WININET.dll_InternetConnectA]
lea ecx, [ebp - 0x120]
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x11a]
movzx eax, word [ebp - 0x11e]
movzx ecx, word [ebp - 0x120]
push edx
push eax
push ecx
lea edx, [ebp - 0x110]
push str._04d__02d__02d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.WININET.dll_FtpCreateDirectoryA]
lea ecx, [ebp - 0x110]
lea esi, [ebp - 0x140]
call fcn.10004360
cmp dword [ebp - 0x128], 0x10
mov eax, dword [ebp - 0x13c]
jae 0x10004185
lea eax, [ebp - 0x13c]
push 0
push 2
push eax
push str.image.jpeg
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x100041a6
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push ebx
call esi
push str.image.jpeg
call dword [sym.imp.MSVCR100D.dll_remove]
add esp, 4
lea ecx, [ebp - 0x140]
push ecx
call fcn.10004bd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
Function at 0x100041e0
Capabilities:
Check for time delay via gettickcount
Connect to http server
Create http request
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov dword [ebp - 0x210], eax
call esi
sub eax, dword [0x1014cb70]
cmp eax, 0x927c0
jb 0x1000421a
call esi
mov dword [0x1014cb70], eax
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
movzx ecx, word [0x10156b1c]
push 0
push 0
push 1
push 0x10156b40
push 0x10156b20
push ecx
mov edi, eax
push 0x10156afc
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edx, dword [str.Tools]
push 0xfe
mov esi, eax
mov ax, word [0x1002430c]
lea ecx, [ebp - 0x102]
push 0
push ecx
mov dword [ebp - 0x108], edx
mov word [ebp - 0x104], ax
call sub.MSVCR100D.dll_memset
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push esi
call dword [sym.imp.WININET.dll_FtpCreateDirectoryA]
mov eax, dword [ebp - 0x210]
push eax
lea ecx, [ebp - 0x108]
push ecx
push str._s__s
lea edx, [ebp - 0x20c]
push 0x104
push edx
call dword [sym.imp.MSVCR100D.dll_sprintf_s]
add esp, 0x14
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push ebx
push esi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x100042da
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001ed20
mov esp, ebp
pop ebp
ret 4

Function at 0x10004d20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1014cb98]
cmp eax, 0x64
jle 0x10004d41
mov eax, 1
jmp 0x10004d42
inc eax
push eax
mov dword [0x1014cb98], eax
lea eax, [ebp - 0x28]
push 0x10024460
push eax
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
push 0xf003f
push 0
push str.SOFTWAREWebzenMuConfig
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004d9b
push 0x24
lea edx, [ebp - 0x28]
push edx
push 1
push eax
mov eax, dword [ebp - 0x2c]
push str.VolumeEffect
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
Function at 0x10005990
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, eax
movzx eax, byte [edi + 4]
push eax
push str.r_jj
call fcn.1001af60
add esp, 4
push eax
push 0
mov ecx, 0x1014cba8
call fcn.1000b200
movzx eax, byte [edi + 4]
add esp, 0xc
cmp eax, 0xb
ja case.default.0x100059c4
jmp dword [eax*4 + 0x10005b9c]
mov ecx, 0xe
push 0x1388
call fcn.1000b950
push eax
push 2
mov eax, 0x10156df0
call fcn.1001ade0
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov ecx, 0xf
jmp 0x100059d0
mov ecx, 0x10
jmp 0x100059d0
mov ecx, 0x11
jmp 0x100059d0
mov ecx, 0x12
jmp 0x100059d0
mov ecx, 0x13
jmp 0x100059d0
mov ecx, 0x14
jmp 0x100059d0
mov ecx, 0x16
jmp 0x100059d0
mov ecx, 0x18
jmp 0x100059d0
mov ecx, 0x19
jmp 0x100059d0
push 0x7d0
mov ecx, 0x64
call fcn.1000b950
push eax
push 2
mov eax, 0x10156df0
call fcn.1001ade0
add esp, 0xc
mov ecx, 0x15
call fcn.1000b950
mov esi, eax
push esi
push 1
push 2
push 0x1002e028
call fcn.1001af60
add esp, 4
push eax
push 0
mov ecx, 0x1014cba8
call fcn.1000b200
mov eax, dword [0x10156ba4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_UnregisterClassA]
add esp, 0x14
test eax, eax
je 0x10005ab2
push 0
push 0
push 0x10
push eax
call edi
mov ecx, dword [0x10158094]
mov edx, dword [str.SPLASH]
push ecx
push edx
mov dword [0x10156ba4], 0
call ebx
mov eax, dword [0x10156ccc]
test eax, eax
je 0x10005add
push 0
push 0
push 0x10
push eax
call edi
mov eax, dword [0x10158094]
mov ecx, dword [str.SPLASH]
push eax
push ecx
mov dword [0x10156ccc], 0
call ebx
mov eax, dword [0x10156df4]
test eax, eax
je 0x10005b08
push 0
push 0
push 0x10
push eax
call edi
mov edx, dword [0x10158094]
mov eax, dword [str.SPLASH]
push edx
push eax
mov dword [0x10156df4], 0
call ebx
push 0x2b39c0
mov eax, esi
push 0x6a
mov esi, 0x10156df0
call fcn.1001a580
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push esi
push 0x1001ad40
push 0
push 0
mov dword [0x10156df8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x10156df8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x10156df8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10156df4]
test eax, eax
je 0x10005b94
push 0
push 0
push 0x10
push eax
call edi
mov eax, dword [0x10158094]
mov ecx, dword [str.SPLASH]
push eax
push ecx
mov dword [0x10156df4], 0
call ebx
call fcn.1001a9e0
lea ecx, [ecx]
ljmp 0x59
Function at 0x10006280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, 0x15
call fcn.1000b950
push eax
push 1
push 2
push 0x1002e028
mov dword [ebp - 4], eax
call fcn.1001af60
add esp, 4
push eax
xor esi, esi
push esi
mov ecx, 0x1014cba8
call fcn.1000b200
mov eax, dword [0x10156ba4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_UnregisterClassA]
add esp, 0x14
cmp eax, esi
je 0x100062e8
push esi
push esi
push 0x10
push eax
call edi
mov eax, dword [0x10158094]
mov ecx, dword [str.SPLASH]
push eax
push ecx
mov dword [0x10156ba4], esi
call ebx
mov eax, dword [0x10156ccc]
cmp eax, esi
je 0x1000630d
push esi
push esi
push 0x10
push eax
call edi
mov edx, dword [0x10158094]
mov eax, dword [str.SPLASH]
push edx
push eax
mov dword [0x10156ccc], esi
call ebx
mov eax, dword [0x10156df4]
cmp eax, esi
je 0x10006333
push esi
push esi
push 0x10
push eax
call edi
mov ecx, dword [0x10158094]
mov edx, dword [str.SPLASH]
push ecx
push edx
mov dword [0x10156df4], esi
call ebx
mov eax, dword [ebp - 4]
push 0x2b39c0
push 0x6a
mov esi, 0x10156df0
call fcn.1001a580
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push esi
push 0x1001ad40
push 0
push 0
mov dword [0x10156df8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x10156df8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x10156df8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10156df4]
test eax, eax
je 0x100063bf
push 0
push 0
push 0x10
push eax
call edi
mov edx, dword [0x10158094]
mov eax, dword [str.SPLASH]
push edx
push eax
mov dword [0x10156df4], 0
call ebx
call fcn.1001a9e0
int3
Function at 0x10009480
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x100094ca
mov eax, dword [ebp + 8]
mov dword [0x10158094], eax
call fcn.10016760
call fcn.10016870
push 0
push 0
push 0
push 0x10008490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0xe609e8], 5
jne 0x100094ca
cmp dword [0x8128ac4], 0
jne 0x100094ca
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100097e0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
xor ebx, ebx
mov eax, 1
cmp dword [0x1015d374], ebx
jle 0x100098cb
push edi
xor edi, edi
push esi
jmp 0x10009800
mov ecx, dword [0x1015d380]
mov eax, dword [0x1015d37c]
sub ecx, eax
sar ecx, 5
cmp ecx, ebx
ja 0x1000986f
push 0x3a4
push str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VCinclude_vector
push 0x10024b4c
call dword [sym.imp.MSVCP100D.dll_void___cdecl_std::_Debug_message_wchar_t_const___wchar_t_const___unsigned_int_]
push str._Standard_C_Libraries_Out_of_Range___0
push 0
push 0x3a5
push str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VCinclude_vector
push 2
call dword [sym.imp.MSVCR100D.dll__CrtDbgReportW]
add esp, 0x20
cmp eax, 1
jne 0x1000984b
int3
push 0
push 0x3a5
push str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VCinclude_vector
push str.std::vector_class_std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char____class_std::allocator_class_std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char_______::operator___
push str._out_of_range_
call dword [sym.imp.MSVCR100D.dll__invalid_parameter]
mov eax, dword [0x1015d37c]
add esp, 0x14
cmp dword [edi + eax + 0x18], 0x10
jb 0x1000987c
mov eax, dword [edi + eax + 4]
jmp 0x10009880
lea eax, [edi + eax + 4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100098ba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add edi, 0x20
cmp ebx, dword [0x1015d374]
jl 0x10009800
pop esi
pop edi
mov eax, 1
pop ebx
ret
inc ebx
mov dword [0x1015d390], esi
pop esi
mov dword [0x1015d38c], ebx
xor eax, eax
pop edi
pop ebx
ret
Function at 0x1000a9e0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push 3
push 0
push 1
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp + 0xc]
push closesocket
push eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000aa33
lea edx, [ebp - 0x38]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1000aa46
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push edi
push 0
push eax
push ecx
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
jne 0x1000aa7d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x1000aabb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000aab4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000aab4
mov edx, 0x14c
cmp word [ecx + 4], dx
je 0x1000aadb
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x44]
mov dword [ebx], esi
mov dword [edx], edi
mov edx, dword [ebp - 0x3c]
mov dword [edx], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.1001ed20
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b0e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1014cdc0]
push ebx
push esi
push edi
test eax, eax
js 0x1000b1ed
cmp eax, 1
jge 0x1000b1ed
mov esi, eax
imul esi, esi, 0x214
add esi, 0x1014cbac
push str..Xenos_SystemLogs
inc eax
lea ebx, [esi + 4]
push 0x100
mov dword [0x1014cdc0], eax
push ebx
mov dword [esi], 1
call dword [sym.imp.MSVCR100D.dll_strcpy_s]
add esp, 0xc
cmp dword [esi], 0
je 0x1000b1ed
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
push eax
push ecx
push edx
push ebx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.log
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x1000b1c8
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000b1ed
mov ecx, dword [esi + 0x210]
push ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
Function at 0x1000b200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
js 0x1000b3f7
cmp eax, dword [ecx + 0x218]
jge 0x1000b3f7
imul eax, eax, 0x214
cmp dword [eax + ecx + 4], 0
lea esi, [eax + ecx + 4]
je 0x1000b3f7
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x812]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, dword [esi + 0x104]
jne 0x1000b286
movzx edx, word [ebp - 0x816]
cmp edx, dword [esi + 0x108]
jne 0x1000b286
movzx eax, word [ebp - 0x818]
cmp eax, dword [esi + 0x10c]
je 0x1000b343
mov ecx, dword [esi + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebp - 0x812]
movzx ecx, word [ebp - 0x816]
movzx edx, word [ebp - 0x818]
push eax
push ecx
push edx
mov dword [esi + 0x10c], edx
lea edx, [esi + 4]
push edx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.log
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
call ebx
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x1000b30d
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000b343
mov eax, dword [esi + 0x210]
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
push 0x3ff
lea ecx, [ebp - 0x807]
push 0
push ecx
mov byte [ebp - 0x808], 0
call sub.MSVCR100D.dll_memset
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
lea ecx, [ebp - 0x808]
push 0x400
push ecx
call dword [sym.imp.MSVCR100D.dll_vsprintf_s]
push 0x3ff
lea edx, [ebp - 0x407]
push 0
push edx
mov byte [ebp - 0x408], 0
call sub.MSVCR100D.dll_memset
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
lea eax, [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x810]
push ecx
push edx
push eax
lea ecx, [ebp - 0x408]
push str._02d:_02d:_02d__s_r_n
push ecx
call ebx
lea eax, [ebp - 0x408]
add esp, 0x40
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000b3d0
mov ecx, dword [esi + 0x210]
sub eax, edx
push 0
lea edx, [ebp - 0x81c]
push edx
push eax
lea eax, [ebp - 0x408]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ed20
mov esp, ebp
pop ebp
ret

Function at 0x1000b440
Capabilities:
Create thread

Disassembly:
cmp dword [0x1015d208], 0
je 0x1000b486
mov eax, dword [0x10158094]
push 0x1015d5b4
mov dword [0x1014cdc8], eax
xor eax, eax
push eax
push 0x1014cdc4
push 0x1000b570
push eax
push eax
mov dword [0x1014cdd0], eax
mov dword [0x1014cdd4], eax
mov dword [0x1014cdd8], eax
mov dword [0x1014cddc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1014cdcc], eax
ret
Function at 0x1000b490
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x1015d22c], 0
je 0x1000b4ad
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x1015d22c]
cmp eax, dword [ecx]
jne case.0x1000b4e3.0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi*4 + 0x1014cdd0]
cmp eax, 0x1388
jb 0x1000b4d8
call edi
mov dword [esi*4 + 0x1014cdd0], eax
mov dword [esi*4 + 0x1014cdd8], 0
mov eax, dword [0x1015d20c]
pop edi
cmp eax, 5
ja case.default.0x1000b4e3
jmp dword [eax*4 + 0x1000b550]
inc dword [esi*4 + 0x1014cdd8]
cmp dword [esi*4 + 0x1014cdd8], 0x19
jmp 0x1000b53d
inc dword [esi*4 + 0x1014cdd8]
cmp dword [esi*4 + 0x1014cdd8], 0x14
jmp 0x1000b53d
inc dword [esi*4 + 0x1014cdd8]
cmp dword [esi*4 + 0x1014cdd8], 0xf
jmp 0x1000b53d
inc dword [esi*4 + 0x1014cdd8]
cmp dword [esi*4 + 0x1014cdd8], 0xa
jmp 0x1000b53d
inc dword [esi*4 + 0x1014cdd8]
cmp dword [esi*4 + 0x1014cdd8], 5
jbe case.0x1000b4e3.0
push 0
push 0
push 9
call fcn.10006030
add esp, 0xc
ret

Function at 0x1000b710
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREWebzenMuConfig
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000b783
lea ecx, [ebp - 8]
push ecx
push 0x1014cde4
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push str.LangSelection
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000b779
push 0x10024fd8
push 0x10
push 0x1014cde4
call dword [sym.imp.MSVCR100D.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x1000caa0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000cbc4
push 0x104
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1000cbbd
lea ecx, [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x210]
call fcn.1001aa80
add esp, 4
test al, al
je 0x1000cbbd
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x458]
call fcn.1000a530
test al, al
jne 0x1000cb44
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [ebp - 0x458]
push eax
push 1
call fcn.10006030
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x458]
call fcn.1000ac80
test al, al
jne 0x1000cb84
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea edx, [ebp - 0x458]
push edx
push 2
call fcn.10006030
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
call fcn.10007cb0
test al, al
jne 0x1000cbbd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [ebp - 0x458]
push eax
push 5
call fcn.10006030
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
Function at 0x1000d170
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1594
call fcn.1001fae0
mov eax, dword [0x1002e018]
xor eax, esp
mov dword [esp + 0x1590], eax
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x150]
xor edi, edi
push ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x1000d1ca
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1590]
xor ecx, esp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x14]
shr esi, 2
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], esi
cmp esi, edi
jle 0x1000d2c0
lea eax, [esp + edi*4 + 0x148]
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
test eax, eax
je 0x1000d2b3
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x1000d2ac
push 0x104
lea edx, [esp + 0x118c]
push edx
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1000d2ac
lea esi, [esp + 0x1188]
call fcn.1001acf0
push eax
lea eax, [esp + 0x114c]
push 0x100245dc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, esi
add esp, 0xc
push ecx
lea ecx, [esp + 0x1394]
call fcn.1001aa80
add esp, 4
test al, al
je 0x1000d2a8
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov dword [esp + 0x20], eax
mov ecx, 8
lea esi, [esp + 0x1148]
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1390]
push ecx
lea edx, [esp + 0x48]
push 0x10025a84
push edx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
call fcn.1000de60
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [esp + 0x10], edi
cmp edi, esi
jl 0x1000d1e1
mov ecx, dword [esp + 0x159c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.1001ed20
mov esp, ebp
pop ebp
ret