joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b60e0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6a80
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b6186
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b6186
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b6186
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b6990
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x12
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6ac8
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b6a36
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b6a36
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b6a36
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b6a50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x12
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6af0
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b6ac9
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b6afd
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b6afd
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b6afd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100cc9b0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x12
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6b18
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b6b44
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b6b6d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b6b6d
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b6b96
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b6b96
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b6b96
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b6c40
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6b40
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b6ce6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b6ce6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b6ce6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b6d00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6b5c
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b6d79
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b6dad
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b6dad
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b6dad
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100cd540
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6b78
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b6df4
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b6e1d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b6e1d
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b6e46
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b6e46
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b6e46
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b6ef0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x11
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f71f0
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b6f96
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b6f96
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b6f96
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b7040
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x13
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f72ec
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b70e6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b70e6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b70e6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b7190
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xd
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f7404
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b7236
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b7236
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b7236
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b8150
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f75a8
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x1c]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b81cc
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x100b8200
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b8200
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b8200
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
add ebx, 0xc
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push ebx
mov byte [ecx], 0
call fcn.10006b20
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 4]
call fcn.100ce770
test al, al
je 0x100b8258
mov byte [ebp - 0xd], 1
jmp 0x100b8282
push str.insert_current_process_info_to_db...
push 1
push 0x4a
push 0x100f75f0
push str.CProcessControl::InsertCurrentProcessInfoToDB
call fcn.100d1270
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
add esp, 0x14
mov eax, dword [eax + 0x10]
push ebx
call eax
mov byte [ebp - 0xd], al
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f765c
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x1c]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b82be
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b82e7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b82e7
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x100b8310
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b8310
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b8310
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x100b833b
mov edi, dword [ebp - 0x24]
mov esi, ebx
cmp ebx, edi
je 0x100b8331
mov ecx, esi
call fcn.100b7480
add esi, 0x13c
cmp esi, edi
jne 0x100b8320
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c3da0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
push str.start_websocket...
push 1
push 0xac
push 0x100f8978
push str.CClientWebsocket::Start
mov edi, ecx
call fcn.100d1270
add esp, 0x14
cmp byte [0x10119bd0], 0
jne 0x100c3de0
call fcn.100c42f0
mov byte [0x10119bd0], 1
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov byte [edi], 0
mov byte [0x1011938c], 0
mov byte [0x1011938d], 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 0xb0], eax
call esi
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [edi + 0xb4], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 1
push 0
mov dword [edi + 0xb8], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xbc], eax
lea eax, [esp + 8]
push eax
push 0
push edi
push 0x100c43e0
push 0
push 0
mov dword [esp + 0x20], 0
call esi
mov dword [edi + 0x38], eax
lea eax, [esp + 0xc]
push eax
push 0
push edi
push 0x100c4720
push 0
push 0
mov dword [esp + 0x24], 0
call esi
mov dword [edi + 0x3c], eax
lea eax, [esp + 0x10]
push eax
push 0
push edi
push 0x100c3be0
push 0
push 0
mov dword [esp + 0x28], 0
call esi
mov dword [edi + 0xc0], eax
lea eax, [esp + 0x14]
push eax
push 0
push edi
push 0x100c3cf0
push 0
push 0
mov dword [esp + 0x2c], 0
call esi
mov dword [edi + 0xc4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100c42f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x2c
mov esi, eax
lea eax, [ebp - 0x2c]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x30], 0x30
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x100c4160
mov dword [ebp - 0x1c], esi
push eax
mov dword [ebp - 8], 0x100f8ab0
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x100c4372
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegisterClassEx_fail__code:__d_
push 3
push 0x1c2
push 0x100f8b10
push 0x100f8b80
call fcn.100d1600
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0
push 0
push 0x64
push 0x64
push 0x64
push 0x64
push 0xcf0000
push 0x100f8bb8
push str.CLIENTWEBSOCKET
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x100c43c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateWindowEx_fail__code:__d_
push 3
push 0x1c9
push 0x100f8c38
push str.CClientWebsocket::CreateWnd
call fcn.100d1600
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c65a0
Capabilities:
Terminate process

Disassembly:
push esi
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x100c65b9
xor al, al
pop esi
ret
push ebx
push 0x666
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x100c65da
push 0x3e8
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
ret
Function at 0x100d1050
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4dcb
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x10115034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.100d16f0
add esp, 8
cmp byte [0x10118ba1], 0
mov dword [ebp - 4], 0
je 0x100d1175
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x14], 0x10
jb 0x100d10e0
mov ecx, dword [esi]
jmp 0x100d10e2
mov ecx, esi
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
push ecx
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12c]
push str.__d._d._s._s___s_n
push eax
call fcn.100d1d00
add esp, 0x1c
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x118], 0x10
jb 0x100d115a
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [0x10118ba8]
test eax, eax
jne 0x100d11a5
push 0x18
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [0x10118ba8], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x10118ba8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.100d7b70
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x100d11cf
push eax
push eax
call fcn.100d0cb0
add esp, 8
push dword [0x10118ba8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.100d7b70
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x100d11fd
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x100d11fd
cmp ecx, 3
ja case.default.0x100d11fd
jmp dword [ecx*4 + 0x100d125c]
push esi
mov ecx, edi
call fcn.100d7640
jmp case.default.0x100d11fd
push esi
mov ecx, edi
call fcn.100d7c40
jmp case.default.0x100d11fd
push esi
mov ecx, edi
call fcn.100d8110
jmp case.default.0x100d11fd
push esi
mov ecx, edi
call fcn.100d7980
cmp dword [ebp - 0x130], 0x10
jb 0x100d1241
push dword [ebp - 0x144]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dc8fb
mov esp, ebp
pop ebp
ret
Function at 0x100d1af0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10115034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.100d2670
add esp, 4
cmp dword [ebp + 0x18], 0
jle 0x100d1ccc
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001a60
call fcn.100d1f30
add esp, 0x18
test al, al
je 0x100d1b6f
mov bl, 1
jmp 0x100d1cce
call fcn.100d22a0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10005c80
mov esi, eax
add esp, 0xc
lea eax, [ebp + 8]
cmp eax, esi
je 0x100d1bbc
cmp dword [ebp + 0x1c], 8
jb 0x100d1b9f
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.10001900
cmp dword [ebp - 0x14], 8
jb 0x100d1bcd
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [ebp + 8]
push eax
call fcn.100d2140
mov ecx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
cmp ecx, esi
jbe 0x100d1c7d
cmp ecx, esi
jbe 0x100d1cc1
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
cmp word [eax + esi*2], 0x5c
jne 0x100d1c74
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.1000c110
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.10001a60
call fcn.100d1f30
add esp, 0x18
test al, al
jne 0x100d1c5c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x100d1c71
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp + 0x18]
inc esi
cmp ecx, esi
ja 0x100d1bf7
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call edi
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001a60
call fcn.100d1f30
add esp, 0x18
test al, al
je 0x100d1ccc
mov bl, 1
jmp 0x100d1cce
push str.invalid_string_position
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xout_of_range_char_const__]
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x100d1cdf
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dc8fb
mov esp, ebp
pop ebp
ret
Function at 0x100d1f30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4f68
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.100d2140
add esp, 4
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x100d1f8e
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret