joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101162f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], ecx
mov eax, dword [ebp - 0x108]
movzx ecx, byte [eax + 4]
and ecx, 2
jne 0x1011631a
jmp 0x1011636c
mov edx, dword [ebp - 0x108]
add edx, 0x45
push edx
push str.XTEAM_MAIN_10405__s
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x10116364
lea edx, [ebp - 0x104]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x1011636c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret

Function at 0x10116380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101da03b
mov eax, dword fs:[0]
push eax
sub esp, 0x510
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x25c], 0
jne 0x101163c5
jmp 0x101164c5
push 0x104
push 0
lea ecx, [ebp - 0x114]
push ecx
call fcn.1019aa40
add esp, 0xc
push 0x104
lea edx, [ebp - 0x114]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x101163fb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0xd3
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.10121e70
add esp, 4
push eax
call fcn.101ac48c
add esp, 8
test eax, eax
je 0x1011642b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x51c]
add eax, 0xd3
push eax
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx ecx, al
test ecx, ecx
jne 0x10116483
push 0x10
push 0x101f82fc
push 0x101f8304
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x51c]
mov eax, dword [edx + 0x25c]
cmp eax, dword [ebp - 0x118]
je 0x101164b3
push 0x10
push 0x101f8318
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x101164e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101da07b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x260], 0
jne 0x10116525
jmp 0x1011665e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0xf3
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x1011657e
push 0x10
push 0x101f8334
push str.Plugin_1_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x260]
cmp edx, dword [ebp - 0x118]
je 0x1011659a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0xf3
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x101165c3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10116609
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x260]
cmp ecx, dword [ebp - 0x118]
je 0x10116625
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f8350
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x1011664c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10116680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101da07b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x264], 0
jne 0x101166c5
jmp 0x101167fe
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x113
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x1011671e
push 0x10
push 0x101f835c
push str.Plugin_2_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x264]
cmp edx, dword [ebp - 0x118]
je 0x1011673a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x113
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10116763
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x101167a9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x264]
cmp ecx, dword [ebp - 0x118]
je 0x101167c5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f8378
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x101167ec
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10116820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101da07b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x268], 0
jne 0x10116865
jmp 0x1011699e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x133
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x101168be
push 0x10
push 0x101f8384
push str.Plugin_3_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x268]
cmp edx, dword [ebp - 0x118]
je 0x101168da
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x133
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10116903
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10116949
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x268]
cmp ecx, dword [ebp - 0x118]
je 0x10116965
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f83a0
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x1011698c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x101169c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101da07b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x26c], 0
jne 0x10116a05
jmp 0x10116b3e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x153
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x10116a5e
push 0x10
push 0x101f83ac
push str.Plugin_4_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x26c]
cmp edx, dword [ebp - 0x118]
je 0x10116a7a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x153
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10116aa3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10116ae9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x26c]
cmp ecx, dword [ebp - 0x118]
je 0x10116b05
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f83c8
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x10116b2c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10116b60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101da07b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x270], 0
jne 0x10116ba5
jmp 0x10116cde
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x173
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x10116bfe
push 0x10
push 0x101f83d4
push str.Plugin_5_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x270]
cmp edx, dword [ebp - 0x118]
je 0x10116c1a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x173
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10116c43
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10116c89
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x270]
cmp ecx, dword [ebp - 0x118]
je 0x10116ca5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f83f0
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x10116ccc
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10116d00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101da07b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x274], 0
jne 0x10116d45
jmp 0x10116e7e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x193
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x10116d9e
push 0x10
push 0x101f83fc
push str.Plugin_Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x274]
cmp edx, dword [ebp - 0x118]
je 0x10116dba
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x193
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10116de3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10116e29
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x274]
cmp ecx, dword [ebp - 0x118]
je 0x10116e45
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f8420
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x10116e6c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10116ea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101da07b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x51c], ecx
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x278], 0
jne 0x10116ee5
jmp 0x1011701e
lea ecx, [ebp - 0x518]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x51c]
add edx, 0x1b3
push edx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx eax, al
test eax, eax
jne 0x10116f3e
push 0x10
push str.Error
push str.Plugin_HackDLL_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x278]
cmp edx, dword [ebp - 0x118]
je 0x10116f5a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
add eax, 0x1b3
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jne 0x10116f83
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x518]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10116fc9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax + 0x278]
cmp ecx, dword [ebp - 0x118]
je 0x10116fe5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x101f8450
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
je 0x1011700c
call dword [ebp - 0x524]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10007120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10119a70
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 6]
cmp ecx, 1
jne 0x10119b06
push 1
mov ecx, 0x104e05c8
call fcn.100b1180
mov dword [ebp - 0xc], 0
jmp 0x10119aa4
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp dword [ebp - 0xc], ecx
jge 0x10119b04
imul edx, dword [ebp - 0xc], 0x1a
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 7]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x14
push ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0xe]
push eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 0x12]
push edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 1
push edx
mov ecx, 0x104e05c8
call fcn.100b1220
jmp 0x10119a9b
jmp 0x10119b81
push 0
mov ecx, 0x104e05c8
call fcn.100b1180
mov dword [ebp - 0x10], 0
jmp 0x10119b24
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 5]
cmp dword [ebp - 0x10], edx
jge 0x10119b81
imul eax, dword [ebp - 0x10], 0x1a
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 7]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x18]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x14
push edx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0xe]
push ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x12]
push eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, 0x104e05c8
call fcn.100b1220
jmp 0x10119b1b
mov esp, ebp
pop ebp
ret

Function at 0x1011a630
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 0x80f8e0
call eax
cmp dword [0xe609e8], 5
je 0x1011a649
jmp 0x1011a6fb
cmp dword [0x10216f6c], 1
je 0x1011a657
jmp 0x1011a6fb
movzx ecx, byte [0x10213fcc]
test ecx, ecx
je 0x1011a680
push 0
push 0
push 0
push 2
call fcn.1011ab10
add esp, 0x10
mov edx, 0x63a180
mov ecx, 0x8793750
call edx
jmp 0x1011a6fb
call fcn.1011a700
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10216f60]
cmp eax, dword [0x10216f58]
jbe 0x1011a6b7
push 0
push 0
push 0
push 2
call fcn.1011ab10
add esp, 0x10
mov eax, 0x63a180
mov ecx, 0x8793750
call eax
jmp 0x1011a6fb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10216f64]
cmp eax, dword [0x10216f5c]
jae 0x1011a6cd
jmp 0x1011a6fb
mov ecx, dword [0x10216f68]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x1011a6e4
cmp dword [ebp - 4], 1
je 0x1011a6eb
jmp 0x1011a6f0
call fcn.1011aba0
jmp 0x1011a6f0
call fcn.1011abe0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10216f64], eax
mov esp, ebp
pop ebp
ret
Function at 0x1011ab10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [0x10216f6c], eax
mov ecx, dword [ebp + 0xc]
mov dword [0x10216f68], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10216f64], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10216f60], eax
mov edx, dword [ebp + 0x10]
mov dword [0x10216f5c], edx
mov eax, dword [ebp + 0x14]
mov dword [0x10216f58], eax
cmp dword [ebp + 8], 0
jne 0x1011ab5d
mov dword [ebp - 4], 0
jmp 0x1011ab66
mov ecx, dword [0x10216f54]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [0x10216f54], edx
cmp dword [ebp + 8], 0
jne 0x1011ab7e
mov dword [ebp - 8], 0
jmp 0x1011ab86
mov eax, dword [0x10216f50]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [0x10216f50], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1011bed0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], 0x288
push 0x12
call fcn.101a2df9
add esp, 4
mov dword [ebp - 0x14], eax
push 0x288
call fcn.101a2df9
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1011bf2d
push 0x101f8514
call sym.Main.dll_printf
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call fcn.101a320e
add esp, 4
xor eax, eax
jmp 0x1011c06e
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1011bf81
mov eax, dword [ebp - 0x10]
push eax
call fcn.101a320e
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.101a2df9
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1011bf81
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call sym.Main.dll_printf
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.101a320e
add esp, 4
xor eax, eax
jmp 0x1011c06e
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1011c05f
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
shl ecx, 2
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
imul edx, ecx, 3
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 1
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + eax + 0x194]
push edx
push str._02X:_02X:_02X:_02X:_02X:_02X
mov eax, dword [ebp - 0x14]
push eax
call sym.Main.dll_sprintf
add esp, 0x20
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1b0
push edx
push str.Address:__s__mac:__s_n
call sym.Main.dll_printf
add esp, 0xc
push 0x101f85bc
call sym.Main.dll_printf
add esp, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x1011bf9d
mov edx, dword [ebp - 0x10]
push edx
call fcn.101a320e
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret