joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10055680
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af82f
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100dbc1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 4]
call esi
push 0
push dword [edi + 0xa8]
call esi
mov eax, dword [edi + 0x190]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10055701
push dword [eax + 4]
call esi
test eax, eax
je 0x100556e6
mov eax, dword [edi + 0x190]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [edi + 0x190]
test ecx, ecx
je 0x100556f7
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [edi + 0x190], 0
cmp dword [ebp + 0xc], 0
je 0x10055713
mov ecx, edi
call fcn.10052e40
jmp 0x10055820
mov eax, dword [edi + 0x1f0]
test eax, eax
je 0x1005573d
push dword [eax + 4]
call esi
test eax, eax
je 0x1005573d
mov eax, dword [edi + 0x1f0]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10055820
mov eax, dword [edi + 0x1ec]
test eax, eax
je 0x10055754
push dword [eax + 4]
call esi
test eax, eax
jne 0x10055820
mov eax, dword [edi + 0x1ec]
test eax, eax
jne 0x100557fc
push 0x54
call fcn.10076018
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x10055785
mov ecx, eax
call fcn.10061740
mov ecx, eax
jmp 0x10055787
xor ecx, ecx
mov eax, dword [edi + 4]
mov dword [edi + 0x1ec], ecx
mov dword [ecx + 0x4c], eax
mov ebx, dword [edi + 0x1ec]
mov dword [ebp - 4], 0xffffffff
call fcn.10053100
cmp dword [eax + 0x30], 0
jne 0x100557b7
call fcn.10053100
mov dword [eax + 0x30], 0
call fcn.10053100
push dword [ebp + 0xc]
lea ecx, [ebx + 0x20]
push ecx
push eax
push 0x100dd6b0
push 0x100e171c
call fcn.1002a320
add esp, 0x14
movzx eax, ax
mov ecx, ebx
push 0
push eax
push 0
push 0
push SysReAllocString
push 0
push 0
push 0
call fcn.1002b190
mov eax, dword [edi + 0x1ec]
test eax, eax
je 0x10055820
push dword [eax + 4]
call esi
test eax, eax
je 0x10055820
mov eax, dword [edi + 0x1ec]
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10058910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100dbc1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp eax, 0x502
jne 0x10058996
cmp dword [edi + 0x164], 0
push 0
push 0
push 0
je 0x1005896b
push dword [edi + 0x1e8]
push 1
call fcn.10053070
mov ecx, eax
call fcn.10037eb0
mov dword [edi + 0x164], 0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100763b4
mov esp, ebp
pop ebp
ret 4
push 0
push 0
mov dword [edi + 0x164], 1
call fcn.10053070
mov ecx, eax
call fcn.10037eb0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100763b4
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x501
jne 0x10058aae
push esi
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [edi + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [edi + 0x190]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100589e8
push dword [eax + 4]
call esi
test eax, eax
je 0x100589e8
mov eax, dword [edi + 0x190]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100589e8
mov eax, dword [edi + 0x74]
sub dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x10058aa3
mov eax, dword [edi + 0x190]
test eax, eax
je 0x10058a55
push dword [eax + 4]
call esi
test eax, eax
je 0x10058a3a
mov eax, dword [edi + 0x190]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [edi + 0x190]
test ecx, ecx
je 0x10058a4b
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [edi + 0x190], 0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0xa8]
call esi
push 0
push dword [edi + 4]
call esi
cmp dword [edi + 0x17c], 0
je 0x10058aad
push 0
push 0
push 0x4d8
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
mov dword [edi + 0x17c], 0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100763b4
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0x17c], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.100763b4
mov esp, ebp
pop ebp
ret 4
Function at 0x100599c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100dbc1c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
je 0x10059ae3
mov eax, dword [edi + 0x188]
mov dword [edi + 0x17c], 1
test eax, eax
je 0x10059a28
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10059a0d
mov eax, dword [edi + 0x188]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [edi + 0x188]
test ecx, ecx
je 0x10059a1e
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [edi + 0x188], 0
push esi
push 0
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 8]
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov esi, edx
sub ecx, dword [edi + 0x14c]
sub esi, dword [edi + 0x148]
sub eax, ecx
push 0x58
push eax
sub edx, esi
lea eax, [ecx - 0x19]
push edx
push eax
lea eax, [esi - 0x12]
push eax
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.100591b0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [edi + 4]
call esi
push 5
push dword [edi + 0xa8]
call esi
mov ecx, dword [edi + 0x24]
lea eax, [edi + 0x24]
push 0
push 0
push eax
call dword [ecx + 0x20]
push 0x105
push 0
push 0
push dword [edi + 0xa8]
call dword [sym.imp.USER32.dll_RedrawWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [edi + 0xa8]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push 1
push 0x4d8
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
push 0
push 0
push 0
push 0
push 1
call fcn.10053070
mov ecx, eax
call fcn.10037eb0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.100763b4
mov esp, ebp
pop ebp
ret 4
Function at 0x10062d60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.100765e0
mov eax, dword [0x100dbc1c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.100837f0
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x10062e52
test edi, edi
je 0x10062e52
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x10062e52
cmp eax, 0x3fff
ja 0x10062e52
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10062e52
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x100b5eb0
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10062e52
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push 0
push edi
call fcn.100837f0
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100763b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100763b4
mov esp, ebp
pop ebp
ret
Function at 0x100694f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10069561
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10069561
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10069561
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10069561
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1006955b
push esi
push ebx
push edi
call fcn.10082cf0
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1006955b
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100699d0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
cmp dword [eax - 0xc], 0
je 0x100699e4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x100c71bc
mov ecx, esi
call fcn.10009e80
push 0
push 0x100c71bc
lea ecx, [esi + 8]
call fcn.10009e80
push 0
push 0x100c71bc
lea ecx, [esi + 0xc]
call fcn.10009e80
push 0
push 0x100c71bc
lea ecx, [esi + 0x10]
call fcn.10009e80
push 0
push 0x100c71bc
lea ecx, [esi + 0x14]
call fcn.10009e80
xorps xmm0, xmm0
mov byte [esi + 0x18], 0
pop edi
movups xmmword [esi + 0x1c], xmm0
pop esi
ret
Function at 0x1006c9ce
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x100b1df1
call fcn.10076bce
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x1006cafa
cmp byte [edi + 0x3d], bl
je 0x1006cafa
mov eax, dword [edi]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100b35e8]
mov ecx, edi
call esi
cmp eax, 0xffffffff
jne 0x1006ca12
xor al, al
jmp 0x1006cafc
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.1006c182
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x1006ca47
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1006ca51
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call dword [0x100b35e8]
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x1006ca81
sub eax, 1
jne 0x1006cadf
mov edi, dword [ebp - 0x30]
jmp 0x1006ca87
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3d], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x1006ca97
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x1006cac1
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1006caa8
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.10096f5b
add esp, 0x10
cmp esi, eax
jne 0x1006caea
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3d], 0
je 0x1006cae8
test esi, esi
jne 0x1006ca39
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.1006c124
jmp 0x1006ca33
dec eax
sub eax, 1
jne 0x1006caee
inc eax
jmp 0x1006caec
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.10011940
mov al, bl
jmp 0x1006cafc
mov al, 1
call fcn.10076b78
ret
Function at 0x1006cf67
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x100b1e46
call fcn.10076bce
mov esi, ecx
mov dword [ebp - 0x30], esi
or ebx, 0xffffffff
cmp dword [ebp + 8], ebx
jne 0x1006cf87
xor eax, eax
jmp 0x1006d100
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1006cfb5
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1006cfb5
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x1006d100
cmp dword [esi + 0x4c], 0
je 0x1006d0fe
mov ecx, esi
call fcn.1006cd2b
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x1006cfee
push dword [esi + 0x4c]
movsx eax, al
push eax
call fcn.1009690f
pop ecx
cmp eax, ebx
mov eax, dword [ebp + 8]
pop ecx
jne 0x1006d100
jmp 0x1006d0fe
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x29], al
mov dword [ebp - 0x14], 0xf
call fcn.1006c182
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x34], edi
cmp ecx, 0x10
jb 0x1006d027
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1006d031
mov edx, eax
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x34]
mov esi, dword [edi]
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x29]
push eax
push dword [ebp - 0x38]
call dword [0x100b35e8]
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x1006d0f6
cmp eax, 1
jg 0x1006d0d8
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x1006d07c
mov edx, eax
mov edi, dword [ebp - 0x3c]
sub edi, edx
je 0x1006d0ab
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1006d08d
mov edx, eax
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push edx
call fcn.10096f5b
add esp, 0x10
cmp edi, eax
jne 0x1006d0f6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
jmp 0x1006d0ae
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x29]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x40], edx
jne 0x1006d0f3
test edi, edi
jne 0x1006d019
cmp dword [ebp - 0x18], 0x20
jae 0x1006d0f6
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.1006c124
jmp 0x1006d013
cmp eax, 3
jne 0x1006d0f6
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
movsx eax, byte [ebp - 0x29]
push eax
call fcn.1009690f
pop ecx
pop ecx
cmp eax, ebx
je 0x1006d0f6
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.10011940
mov eax, ebx
call fcn.10076b78
ret 4
Function at 0x100705c4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10070613
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10070613
cmp esi, dword [ebp + 0x10]
je 0x1007060e
push 0x100bbeb0
push 1
push edi
push edi
call fcn.1006fc57
jmp 0x10070621
xor eax, eax
inc eax
jmp 0x10070626
mov eax, 0x100bbeb0
push eax
push eax
push edi
push edi
call fcn.1006fca4
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x10071813
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1007183d
mov eax, 0x100bbeb0
push eax
push eax
push 0
push 0
call fcn.1006fca4
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x1007257f
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x10072ac0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x10072d7f
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x100b1ee3
call fcn.10076c3c
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.10073550
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x10072ecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10072df8
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.100733af
test eax, eax
je 0x10072e2d
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x10072ecb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10072ecb
push 0x5c0
call fcn.1007308a
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10072e50
push edi
mov ecx, eax
call fcn.10072f0c
jmp 0x10072e52
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x10072ed3
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.100734ef
pop ecx
test eax, eax
jne 0x10072e06
mov dword [ebp - 0xa8], 3
push 0x100d6104
lea eax, [ebp - 0xa8]
jmp 0x10072ee8
mov eax, esi
call fcn.10076b89
ret
mov dword [ebp - 0xa4], 1
push 0x100d6104
lea eax, [ebp - 0xa4]
push eax
call fcn.100828d5
int3
Function at 0x10072f0c
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x100b1f16
call fcn.10076b9a
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.10072d50
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10072f58
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.10076b63
ret 4
push 0x100d6104
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.100828d5
int3

Function at 0x10073124
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.100732b8
mov edi, eax
test edi, edi
je 0x100731af
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x1007315f
mov esi, edi
jmp 0x1007319b
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x10073194
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10073187
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.10073253
jmp 0x1007319b
push 0x100bc1a0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1007319b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.100732b8
mov edi, eax
test edi, edi
jne 0x10073154
test esi, esi
jne 0x100731c4
mov ecx, dword [ebx]
add ecx, 8
call fcn.10073440
mov esi, eax
test esi, esi
je 0x100731c4
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x10074760
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x1007476f
pop ebp
jmp fcn.10074dc0
xor eax, eax
pop ebp
ret 0xc
Function at 0x10075010
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2143
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x100dbc1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x100750b5
cmp word [esi], di
je 0x100750b5
test eax, eax
je 0x10075071
cmp word [eax], di
je 0x10075071
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x100750b5
jmp 0x100750b0
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100837f0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x100750b5
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1007512c
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x10075117
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x100750e5
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x10075106
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x1007514c
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x10075117
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1007512c
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100763b4
mov esp, ebp
pop ebp
ret 0x30
call fcn.1006b66c
int3
Function at 0x1007ba80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x1007bb47
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x1007ba95
pop ebx
pop edi
pop esi
pop ebp
ret