joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9d3e1c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x9f8274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x9f5e6c
push esi
call fcn.009cc273
pop ecx
pop ecx
test eax, eax
jne 0x9d3e4a
xor al, al
jmp 0x9d3ec7
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.009d3b51
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x9d3e84
push dword [ebp - 0x210]
call fcn.009ba4f2
xor al, al
jmp 0x9d3ec5
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x9d3e8a
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x9d3eaa
push edx
call fcn.009d3d53
pop ecx
test al, al
je 0x9d3e75
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x9d3eb8
mov bl, 1
push dword [ebp - 0x210]
call fcn.009ba4f2
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.009b6e52
leave
ret

Function at 0x9d49ac
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x9f8274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x9d49ef
call fcn.009c44e7
mov dword [eax], 0xf
call fcn.009c44fa
mov dword [eax], 0xd
call fcn.009c7dc4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009b6e52
leave
ret
test eax, eax
jne 0x9d49f6
inc eax
jmp 0x9d49e3
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x9d49e1
xor eax, eax
cmp ecx, 1
setne al
jmp 0x9d49e3

Function at 0x408922
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
call fcn.0040894d
xor dword [eax], esi
inc eax
sub ecx, edx
add ecx, ecx
cmp eax, ebx
jne fcn.00408922
sub ecx, 1
sub ecx, 0x1ddb7a6
ret
Function at 0x10001f20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x2c
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x30
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x10001f10
mov dword [esp + 0x1c], esi
push eax
mov dword [esp + 0x34], 0x100b5da4
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x10001faa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegisterClassEx_fail__code:__d_
push 3
push 0x64
push 0x100b5df8
push 0x100b5e38
call fcn.100a59b0
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0
push 0
push 0x64
push 0x64
push 0x64
push 0x64
push 0xcf0000
push 0x100b5e4c
push str.keyboard
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x10001ffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateWindowEx_fail__code:__d_
push 3
push 0x6a
push 0x100b5eb4
push str.CreateWnd
call fcn.100a59b0
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x100d0584
mov byte [0x100d059c], 0
mov dword [0x100d05a0], 0
mov dword [0x100d05a4], 0
mov dword [0x100d05a8], 0
mov dword [0x100d05c0], 0xf
mov dword [0x100d05bc], 0
mov byte [0x100d05ac], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x100d0580
push 0x100057f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100d0580], eax
mov eax, 0x100d0580
mov esp, ebp
pop ebp
ret
Function at 0x100070c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], edi
call fcn.100074e0
test eax, eax
jne 0x1000712b
cmp byte [edi + 8], al
je 0x100070e6
mov byte [edi + 8], al
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.100069f0
mov ecx, dword [ebp - 4]
cmp ecx, dword [edi]
je 0x1000712b
mov esi, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
add ecx, 0x14
push eax
push ecx
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], 0
mov word [esi], ax
call fcn.10001750
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
lea eax, [ebx - 0x30]
cmp eax, 9
ja 0x1000717a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffffff00
and ax, cx
xor ecx, ecx
cmp cx, ax
jne 0x10007163
mov ecx, dword [ebp + 8]
mov dl, bl
call fcn.10006fc0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
mov ecx, edi
push ebx
push esi
call fcn.100072b0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x41]
cmp eax, 0x19
ja 0x100071e3
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov ecx, 0xffffff00
and ax, cx
push 0x12
movzx edi, ax
call esi
mov ecx, 0xffffff00
and ax, cx
xor ecx, ecx
movzx eax, ax
cmp cx, di
jne 0x100071ca
cmp cx, ax
jne 0x100071ca
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 8]
push ebx
push esi
call fcn.100072b0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x100b75fc
call fcn.10002110
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x60]
cmp eax, 9
ja 0x10007202
mov ecx, dword [ebp + 8]
lea edx, [ebx - 0x30]
call fcn.10006fc0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x6a]
cmp eax, 5
ja 0x10007224
mov dl, byte [ebx + 0x100bf7b2]
mov ecx, dword [ebp + 8]
call fcn.10006fc0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x70]
cmp eax, 0x17
ja 0x1000724c
mov esi, dword [ebp + 8]
lea eax, [ebx - 0x6f]
push eax
push 0x100b764c
push esi
call fcn.100089d0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0xba]
cmp eax, 6
jbe 0x10007163
lea eax, [ebx - 0xdb]
cmp eax, 4
jbe 0x10007163
cmp ebx, 0x20
jne 0x10007288
mov ecx, dword [ebp + 8]
push 0x100b7654
call fcn.10002110
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x100b778c
call fcn.10002110
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100072b0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x100c7034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x514], ebx
push 0
mov dword [ebp - 0x518], edi
mov dword [ebp - 0x51c], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov byte [ebp - 0x104], 0
push 0xff
lea eax, [ebp - 0x103]
mov dword [ebp - 0x508], esi
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push esi
mov esi, dword [ebp + 0xc]
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [ebp - 0x50c], eax
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x304], ax
lea eax, [ebp - 0x302]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push dword [ebp - 0x508]
push 0
push 0x100
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x50c]
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x510], eax
push ecx
push eax
push str.ret:__d___s
push 1
push 0xba
push 0x100b7878
push str.CVirtualKeyManager::GetUnicodeVal
call fcn.100a59b0
mov edx, dword [ebp - 0x510]
add esp, 0x1c
cmp edx, 0xffffffff
jne 0x10007411
mov ebx, dword [ebp - 0x50c]
mov edi, dword [ebp - 0x508]
jmp 0x100073c0
push 0xff
lea eax, [ebp - 0x403]
mov byte [ebp - 0x404], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push edi
push 0
push 0x100
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
js 0x100073c0
mov edi, dword [ebp - 0x518]
mov ebx, dword [ebp - 0x514]
mov edx, dword [ebp - 0x510]
cmp dword [edi + 0x10], 0
je 0x100074ac
cmp byte [edi + 9], 0
je 0x100074ac
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x504], ax
lea eax, [ebp - 0x502]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x504]
lea esi, [edi + 0x14]
push dword [ebp - 0x508]
push 0
push 0x100
push eax
push esi
push dword [edi + 0xc]
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_ToUnicodeEx]
push 0x100
push 0
push esi
mov dword [edi + 0x10], 0
mov byte [edi + 9], 0
mov dword [edi + 0xc], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
mov ecx, ebx
call fcn.10002110
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b010b
mov esp, ebp
pop ebp
ret 8
cmp edx, 0xffffffff
mov dword [edi + 0x10], esi
mov ecx, 0x40
lea esi, [ebp - 0x104]
sete al
mov byte [edi + 9], al
mov eax, dword [ebp - 0x50c]
mov dword [edi + 0xc], eax
add edi, 0x14
rep movsd dword es:[edi], dword [esi]
cmp edx, 0xffffffff
jne 0x10007489
push 0x100b780c
jmp 0x10007490
Function at 0x100074e0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1e4b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x100c7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x63
lea eax, [ebp - 0x77]
mov byte [ebp - 0x78], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x78]
push eax
push str.keyboard_name:__s
push 1
push 0xde
push str..._srcKeyboadHookutilVirtualKeyManager.cpp
push str.CVirtualKeyManager::GetSpecialKeyBoard
call fcn.100a5620
add esp, 0x18
mov dword [ebp - 0x7c], 0xf
cmp byte [ebp - 0x78], 0
mov dword [ebp - 0x80], 0
mov byte [ebp - 0x90], 0
jne 0x1000756d
xor ecx, ecx
jmp 0x1000757c
lea ecx, [ebp - 0x78]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007573
sub ecx, edx
push ecx
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x90]
call fcn.100068f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x90]
mov edi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x90]
mov ebx, dword [ebp - 0x90]
lea edx, [ebp - 0x90]
mov esi, dword [ebp - 0x80]
cmp edi, 0x10
cmovae eax, ebx
cmovae ecx, ebx
add eax, esi
cmp edi, 0x10
cmovae edx, ebx
cmp edx, eax
je 0x100075e8
push dword [sym.imp.MSVCR120.dll_towlower]
push ecx
push eax
lea ecx, [ebp - 0x94]
call fcn.100077b0
mov edi, dword [ebp - 0x7c]
add esp, 0xc
mov esi, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x90]
cmp edi, 0x10
lea ecx, [ebp - 0x90]
mov eax, 8
cmovae ecx, ebx
cmp esi, eax
cmovb eax, esi
push eax
push str.0000000a
push ecx
call fcn.10007850
add esp, 0xc
test eax, eax
jne 0x10007620
cmp esi, 8
jb 0x10007620
cmp esi, 8
setne al
test eax, eax
je 0x10007691
cmp edi, 0x10
lea ecx, [ebp - 0x90]
mov eax, 8
cmovae ecx, ebx
cmp esi, eax
cmovb eax, esi
push eax
push str.0000040a
push ecx
call fcn.10007850
add esp, 0xc
test eax, eax
jne 0x10007658
cmp esi, 8
jb 0x10007658
cmp esi, 8
setne al
test eax, eax
je 0x10007691
cmp edi, 0x10
lea eax, [ebp - 0x90]
mov ecx, 8
cmovae eax, ebx
cmp esi, 8
cmovb ecx, esi
push ecx
push str.0001040a
push eax
call fcn.10007850
add esp, 0xc
test eax, eax
jne 0x10007698
cmp esi, 8
jb 0x10007698
cmp esi, 8
setne al
test eax, eax
jne 0x10007698
mov esi, 1
jmp 0x100076fa
push str.00000016
lea ecx, [ebp - 0x90]
call fcn.10007930
test eax, eax
je 0x100076ec
push str.00000416
lea ecx, [ebp - 0x90]
call fcn.10007930
test eax, eax
je 0x100076ec
push str.00010416
lea ecx, [ebp - 0x90]
call fcn.10007930
test eax, eax
je 0x100076ec
push str.00000816
lea ecx, [ebp - 0x90]
call fcn.10007930
test eax, eax
je 0x100076ec
xor esi, esi
jmp 0x100076f1
mov esi, 2
mov ebx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x7c]
cmp edi, 0x10
jb 0x10007709
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b010b
mov esp, ebp
pop ebp
ret
Function at 0x1000a690
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2248
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100c7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100b7b14
mov word [ecx], ax
call fcn.10001540
lea ecx, [ebp - 0x1c]
call fcn.10011e70
add esp, 0x18
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100a4680
test al, al
je 0x1000a705
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp - 0x18]
or edi, 0xffffffff
test esi, esi
je 0x1000a732
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x1000a732
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x1000a732
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
add ebx, 0xc
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push ebx
mov byte [ecx], 0
call fcn.10006500
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 4]
call fcn.1000f090
test al, al
je 0x1000a78a
mov byte [ebp - 0xd], 1
jmp 0x1000a7b4
push str.insert_current_process_info_to_db...
push 1
push 0x4a
push 0x100b7b5c
push str.CProcessControl::InsertCurrentProcessInfoToDB
call fcn.100a5620
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
add esp, 0x14
mov eax, dword [eax + 0x10]
push ebx
call eax
mov byte [ebp - 0xd], al
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100b7bc8
mov word [ecx], ax
call fcn.10001540
lea ecx, [ebp - 0x1c]
call fcn.10011e70
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x1000a7f0
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x1000a819
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x1000a819
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x1000a842
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x1000a842
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x1000a842
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x1000a86d
mov edi, dword [ebp - 0x24]
mov esi, ebx
cmp ebx, edi
je 0x1000a863
mov ecx, esi
call fcn.100099c0
add esi, 0x13c
cmp esi, edi
jne 0x1000a852
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b780
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b22e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100c7034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100b7cb0
mov word [ecx], ax
call fcn.10001540
lea ecx, [esp + 0x30]
call fcn.10011e70
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.10011cb0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x1000b826
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x1000b826
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x1000b826
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b840
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b231e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100c7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 0
jne 0x1000b8bd
mov eax, dword [0x100cfe44]
test al, 1
jne 0x1000b8a5
or eax, 1
mov dword [0x100cfe44], eax
mov dword [ebp - 4], 0
call fcn.10009790
push 0x100b44b0
call fcn.100b0205
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp ebx, 0x100cfe54
je 0x1000b8bd
push 0xffffffffffffffff
push 0
push 0x100cfe54
mov ecx, ebx
call fcn.10006500
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100b7cc8
mov word [ecx], ax
call fcn.10001540
lea ecx, [ebp - 0x20]
call fcn.10011e70
add esp, 0x18
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100a4680
test al, al
je 0x1000b905
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp - 0x1c]
or edi, 0xffffffff
test esi, esi
je 0x1000b932
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x1000b932
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x1000b932
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
push ebx
add ecx, 4
call fcn.10012ec0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100b7ce0
mov word [ecx], ax
call fcn.10001540
lea ecx, [ebp - 0x18]
call fcn.10011e70
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x1000b97a
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x1000b9a3
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x1000b9a3
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1000b9cc
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x1000b9cc
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x1000b9cc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bc20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2372
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x100c7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, eax
push eax
push ecx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0xa0], 1
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x98], 0x67452301
mov dword [ebp - 0x94], 0xefcdab89
mov dword [ebp - 0x90], 0x98badcfe
mov dword [ebp - 0x8c], 0x10325476
call fcn.10013100
lea ecx, [ebp - 0x98]
call fcn.10013200
lea ecx, [ebp - 0x98]
call fcn.10013310
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
xor esi, esi
mov dword [ebp - 0x9c], eax
movzx eax, byte [esi + eax]
push eax
lea eax, [ebp - 0x28]
push 0x100b7d04
push eax
call fcn.100088a0
add esp, 0xc
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.10007e80
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0x10
jb 0x1000bd3e
push dword [ebp - 0x28]
call ebx
add esp, 4
mov eax, dword [ebp - 0x9c]
inc esi
cmp esi, 0x10
jl 0x1000bd03
cmp dword [ebp + 0x1c], 8
jb 0x1000bd58
push dword [ebp + 8]
call ebx
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b010b
mov esp, ebp
pop ebp
ret
Function at 0x1000c300
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2446
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x100c7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x41
push str.C:Program_Files__x86_Windows_Assistant_AppMVConfiguration.ini
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
call fcn.100068f0
push 0x3ff
lea eax, [ebp - 0x40f]
mov dword [ebp - 4], 0
push 0
push eax
mov byte [ebp - 0x410], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x440]
cmp dword [ebp - 0x42c], 0x10
cmovae eax, dword [ebp - 0x440]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push 0
push str.UniquePC
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x410], 0
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
jne 0x1000c3e4
xor ecx, ecx
jmp 0x1000c3f9
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c3f0
sub ecx, edx
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x428]
call fcn.100068f0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
lea eax, [ebp - 0x428]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.10006500
mov ecx, edi
call fcn.10008c10
add esp, 0x18
cmp dword [ebp - 0x414], 0x10
jb 0x1000c458
push dword [ebp - 0x428]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [ebp - 0x42c], 0x10
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
jb 0x1000c48b
push dword [ebp - 0x440]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b010b
mov esp, ebp
pop ebp
ret

Function at 0x1000d240
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b22e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100c7034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100b86cc
mov word [ecx], ax
call fcn.10001540
lea ecx, [esp + 0x30]
call fcn.10011e70
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.10011cb0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x1000d2e6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x1000d2e6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x1000d2e6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret