joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4591e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0431
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.00421810
xor eax, eax
mov dword [edi + 8], 0
mov word [edi + 4], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
push esi
mov dword [ebp - 0x10], 1
call fcn.00403030
mov dword [ebp - 4], 1
mov ecx, 0x55553c
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - 0x1c], vtable.AutoLock.0
mov dword [ebp - 0x18], 0x55553c
call dword [eax + 4]
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x3c]
call fcn.0044f110
mov byte [ebp - 4], 3
push dword [ebp - 0x38]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4592da
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [ebp - 0x3c]
mov dword [edi + 8], eax
call fcn.0044f1c0
mov byte [ebp - 4], 4
mov ecx, 0x55553c
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov ax, word [ebp + 8]
lea ecx, [ebp - 0x28]
mov word [edi + 4], ax
mov dword [ebp - 0x2c], vtable.StringStorage.0
call fcn.004039c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x54]
call fcn.00459400
push 0x5523dc
lea eax, [ebp - 0x54]
push eax
call fcn.0049c518
int3

Function at 0x45b450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c05e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x160]
lea ecx, [ebx + 0x160]
mov dword [ebp - 0x14], vtable.AutoLock.0
mov dword [ebp - 0x10], ecx
call dword [eax + 4]
mov dword [ebp - 4], 0
lea edi, [ebx + 0x134]
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 0x1c], vtable.AutoLock.0
mov dword [ebp - 0x18], edi
call dword [eax + 4]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0xf8]
mov byte [ebp - 4], 1
mov eax, dword [esi]
mov dword [ebx + 0xdc], eax
mov eax, dword [esi + 8]
mov dword [ebx + 0xe4], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xe8], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0xec], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0xf0], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0xf4], eax
mov eax, dword [ecx]
push dword [esi + 0x20]
call dword [eax + 4]
movzx eax, byte [esi + 0x2c]
mov byte [ebx + 0x108], al
movzx eax, byte [esi + 0x2d]
mov byte [ebx + 0x109], al
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x10c], eax
mov byte [ebp - 4], 2
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 8]
lea ecx, [ebx + 0x160]
mov dword [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4721e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1be8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.GlobalMutex.0
mov dword [ebp - 0x20], vtable.StringStorage.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
push 1
mov ecx, eax
call fcn.00403af0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x524da8
push ecx
call fcn.0049dfe0
push dword [ebp + 8]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push 0x53714c
push str._s_s
push eax
call fcn.004038c0
add esp, 0x1c
push dword [ebp - 0x1c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4722cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 4]
cmp eax, 0xb7
je 0x4722c6
call fcn.00472350
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.StringStorage.0
call fcn.004039c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x48]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x48]
push eax
call fcn.0049c518
int3

Function at 0x4724e0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1c5e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 8]
mov dword [edi], vtable.Thread.0
push eax
push 4
push edi
push 0x472140
push 0
mov byte [edi + 0xc], 0
push 0
mov byte [edi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
lea esi, [edi + 0x10]
push 0
mov dword [edi], vtable.ThreadCollector.0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040cd10
mov dword [esi], eax
lea eax, [edi + 0x1c]
mov dword [edi + 0x18], vtable.LocalMutex.0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ecx
lea ecx, [edi + 0x34]
mov byte [ebp - 4], 2
call fcn.0041e0f0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [edi + 0xc], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x474420
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1e78
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [0x558fa4]
push str.Try_allow_to_receive_the__u_windows_message
push dword [esi]
mov dword [ebp - 0x10], ebx
call fcn.00405ec0
add esp, 8
cmp dword [0x558e38], 0
jne 0x47448a
push 0x558e38
mov dword [0x558e38], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
neg eax
sbb eax, eax
and dword [0x558e38], eax
cmp dword [0x558e3c], 6
jb 0x474585
push str.user32.dll
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.DynamicLibrary.0
mov dword [ebp - 0x18], 0
call fcn.00420700
mov dword [ebp - 4], 0
push str.user32.dll_successfully_loaded.
push dword [esi]
call fcn.00405ec0
mov edi, dword [ebp - 0x18]
add esp, 8
push str.ChangeWindowMessageFilterEx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x47451a
push str.ChangeWindowMessageFilter
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x4745a8
push str.The_ChangeWindowMessageFilter___function_successfully_found.
push dword [esi]
call fcn.00405ec0
add esp, 8
push 1
push dword [ebp - 0x10]
call ebx
cmp eax, 1
jne 0x4745c7
push str.The_ChangeWindowMessageFilter___function_successfully_executed.
jmp 0x47455c
push str.The_ChangeWindowMessageFilterEx___function_successfully_found.
push dword [esi]
call fcn.00405ec0
add esp, 8
push 0
push 1
push ebx
push dword [ebp + 0xc]
call dword [ebp - 0x14]
cmp eax, 1
je 0x474557
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402fa0
mov byte [ebp - 4], 2
push str.Cant_allow_to_receive_the__d_windows_message_by_the_ChangeWindowMessageFilterEx___function.
jmp 0x4745e0
push str.The_ChangeWindowMessageFilterEx___function_successfully_executed.
push dword [esi]
call fcn.00405ec0
add esp, 8
test edi, edi
je 0x474594
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.The_allowMessage___function_call_is_ignored.
push dword [esi]
call fcn.00405ec0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x30]
push str.Cant_load_the_ChangeWindowMessageFilterEx___or_ChangeWindowMessageFilter___functions.
push eax
call fcn.00403f20
add esp, 8
lea eax, [ebp - 0x30]
push 0x5520b8
push eax
call fcn.0049c518
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402fa0
mov byte [ebp - 4], 1
push str.Cant_allow_to_receive_the__d_windows_message_by_the_ChangeWindowMessageFilter___function.
lea eax, [ebp - 0x2c]
push eax
call fcn.004038c0
add esp, 8
lea ecx, [ebp - 0x2c]
push esi
call fcn.00403150
push eax
lea ecx, [ebp - 0x58]
call fcn.0041d050
push 0x5521e4
lea eax, [ebp - 0x58]
push eax
call fcn.0049c518
int3
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x819030]
jne 0x401073
repz ret
jmp fcn.00401c51

Function at 0x408bad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040499b
and dword [ebp - 4], 0
cmp dword [0x81b850], 0
mov ebx, eax
jne 0x408c5e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408d0f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408d0f
push eax
call fcn.00404929
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81b850], eax
call esi
push eax
call fcn.00404929
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81b854], eax
call esi
push eax
call fcn.00404929
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81b858], eax
call esi
push eax
call fcn.00404929
pop ecx
mov dword [0x81b860], eax
test eax, eax
je 0x408c5e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404929
pop ecx
mov dword [0x81b85c], eax
mov eax, dword [0x81b85c]
cmp eax, ebx
je 0x408cb6
cmp dword [0x81b860], ebx
je 0x408cb6
push eax
call fcn.004049a4
push dword [0x81b860]
mov esi, eax
call fcn.004049a4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408cb6
test edi, edi
je 0x408cb6
call esi
test eax, eax
je 0x408cad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408cad
test byte [ebp - 0xc], 1
jne 0x408cb6
or dword [ebp + 0x10], 0x200000
jmp 0x408cef
mov eax, dword [0x81b854]
cmp eax, ebx
je 0x408cef
push eax
call fcn.004049a4
pop ecx
test eax, eax
je 0x408cef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408cef
mov eax, dword [0x81b858]
cmp eax, ebx
je 0x408cef
push eax
call fcn.004049a4
pop ecx
test eax, eax
je 0x408cef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81b850]
call fcn.004049a4
pop ecx
test eax, eax
je 0x408d0f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408d11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41378d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41378d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10031700
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10156eed
mov eax, dword fs:[0]
push eax
mov eax, 0x112c
call fcn.1014edc0
mov eax, dword [0x101b900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1138], esi
mov dword [ebp - 0x1134], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
push 1
mov dword [ebp - 0x1134], 1
mov dword [ebp - 0x1014], eax
call fcn.10109f02
mov dword [ebp - 0x1014], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x112c]
push eax
call fcn.10121fd0
add esp, 0x10
mov dword [ebp - 0x1130], 0x11c
lea eax, [ebp - 0x1130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100317c3
cmp dword [ebp - 0x112c], 6
mov eax, dword [ebp - 0x1014]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1014]
call fcn.1007b670
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.10121fd0
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1003182e
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10031810
sub ecx, edx
lea eax, [ebp - 0x1010]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003600
lea ecx, [ebp - 0x1014]
call fcn.1007b9e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.1007ada0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ef1
mov esp, ebp
pop ebp
ret 4
Function at 0x10045f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159742
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x101b900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x98], esi
lea edx, [ecx + 2]
mov dword [ebp - 0x94], 0
xor eax, eax
mov dword [ebp - 0x90], 0x6c0047
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x8c], 0x62006f
mov dword [ebp - 0x88], 0x6c0061
mov dword [ebp - 0x84], 0x52005c
mov dword [ebp - 0x80], 0x410043
mov dword [ebp - 0x7c], 0x370056
mov dword [ebp - 0x78], 0x340045
mov dword [ebp - 0x74], 0x440037
mov dword [ebp - 0x70], 0x390041
mov dword [ebp - 0x6c], 0x2d0033
mov dword [ebp - 0x68], 0x460041
mov dword [ebp - 0x64], 0x310034
mov dword [ebp - 0x60], 0x34002d
mov dword [ebp - 0x5c], 0x350034
mov dword [ebp - 0x58], 0x2d0030
mov dword [ebp - 0x54], 0x300039
mov dword [ebp - 0x50], 0x440043
mov dword [ebp - 0x4c], 0x33002d
mov dword [ebp - 0x48], 0x430031
mov dword [ebp - 0x44], 0x380037
mov dword [ebp - 0x40], 0x320031
mov dword [ebp - 0x3c], 0x320035
mov dword [ebp - 0x38], 0x370038
mov dword [ebp - 0x34], 0x5f0044
mov dword [ebp - 0x30], 0x540052
mov dword [ebp - 0x2c], 0x520050
mov dword [ebp - 0x28], 0x54004f
mov dword [ebp - 0x24], 0x430045
mov dword [ebp - 0x20], 0x5f0054
mov dword [ebp - 0x1c], 0x55004d
mov dword [ebp - 0x18], 0x450054
mov dword [ebp - 0x14], 0x58
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10046090
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003600
mov dword [ebp - 4], 0
mov dword [ebp - 0x94], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ef1
mov esp, ebp
pop ebp
ret 4
Function at 0x10046e40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101598f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x101b900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
push eax
call fcn.10045f40
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x10046e7f
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x10046ec9
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046ebf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10046f09
push edx
push ecx
call fcn.1010a295
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test esi, esi
je 0x10046ef6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10129e39
int3

Function at 0x100472a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159a67
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x101b900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
xor bl, bl
mov dword [ebp - 4], 0
mov eax, dword [0x101be5d8]
test al, 1
jne 0x10047329
or eax, 1
mov dword [0x101be5d8], eax
mov byte [ebp - 4], 1
xor eax, eax
push 0x2f
push str.GlobalRCAVD277DCA8_31E4_4750_8F68_057A8C0F2C93
mov ecx, 0x101be628
mov dword [0x101be638], 0
mov dword [0x101be63c], 7
mov word [0x101be628], ax
call fcn.10003600
push 0x10170430
call fcn.1010a280
add esp, 4
mov byte [ebp - 4], bl
push 0x101be628
lea ecx, [ebp - 0x28]
call fcn.10026480
mov dword [ebp - 0x10], 1
cmp dword [eax + 0x14], 8
jb 0x10047345
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1004739d
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047393
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100473e5
push edx
push ecx
call fcn.1010a295
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
test esi, esi
je 0x100473d2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10129e39
int3
Function at 0x1004f720
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015a957
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x101b900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], 0
mov eax, dword [0x101be69c]
test al, 1
jne 0x1004f7a9
or eax, 1
mov dword [0x101be69c], eax
mov dword [ebp - 4], 1
xor eax, eax
push eax
push 0x10182c58
mov ecx, 0x101be684
mov dword [0x101be694], 0
mov dword [0x101be698], 7
mov word [0x101be684], ax
call fcn.10003600
push 0x101706f0
call fcn.1010a280
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x101be684
call fcn.1007e810
test al, al
je 0x1004f7c8
push 0x101be684
mov ecx, esi
call fcn.10026480
jmp 0x1004f98c
lea ecx, [ebp - 0x28]
call fcn.1002d670
mov edi, eax
mov dword [ebp - 4], 2
cmp edi, 0x101be684
je 0x1004f815
mov ecx, 0x101be684
call fcn.10003590
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [0x101be684], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [0x101be694], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1004f853
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004f849
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004f9af
push edx
push ecx
call fcn.1010a295
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [0x101be694], eax
je 0x1004f980
push 0x101b9acc
mov edx, 0x101be684
lea ecx, [ebp - 0x28]
call fcn.1007a270
add esp, 4
mov edi, eax
mov dword [ebp - 4], 3
cmp edi, 0x101be684
je 0x1004f8cd
mov ecx, 0x101be684
call fcn.10003590
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [0x101be684], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [0x101be694], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1004f90b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004f901
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004f9b4
push edx
push ecx
call fcn.1010a295
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov ecx, 0x101be684
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [eax + 0x10]
call fcn.1007a030
mov ecx, 0x101be684
call fcn.1007e810
test al, al
jne 0x1004f944
mov ecx, 0x101be684
call fcn.1007ec30
cmp dword [0x101be698], 8
mov eax, 0x101be684
cmovae eax, dword [0x101be684]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x1004f980
and eax, 0xfffffffd
mov ecx, 0x101be684
cmp dword [0x101be698], 8
push eax
cmovae ecx, dword [0x101be684]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x101be684
mov ecx, esi
call fcn.10026480
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.10129e39
call fcn.10129e39
int3
Function at 0x10053910
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b182
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x101b900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14c], 0
push 1
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x14], 0
call fcn.10109f02
mov dword [ebp - 0x14], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x144]
push eax
call fcn.10121fd0
add esp, 0x10
mov dword [ebp - 0x148], 0x11c
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100539b1
cmp dword [ebp - 0x144], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.1007bcf0
test al, al
je 0x10053aef
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x10053aef
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1007bdd0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
jne 0x100539fc
xor bl, bl
jmp 0x10053a9f
mov byte [ebp - 4], 2
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x16c]
push 0
push dword [ebp - 0x1c]
cmovae edx, dword [ebp - 0x2c]
call fcn.1008aa90
add esp, 8
mov dword [ebp - 0x14c], 1
mov ecx, esi
push eax
call fcn.10053b30
mov eax, 1
mov dword [ebp - 0x14c], eax
and eax, 0xfffffffe
mov dword [ebp - 0x14c], eax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x158]
cmp edx, 0x10
jb 0x10053a82
mov ecx, dword [ebp - 0x16c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10053a78
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10053b1d
push edx
push ecx
call fcn.1010a295
add esp, 8
mov dword [ebp - 0x15c], 0
mov bl, 1
mov dword [ebp - 0x158], 0xf
mov byte [ebp - 0x16c], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10053ad9
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10053acf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10053b22
push edx
push ecx
call fcn.1010a295
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
jmp 0x10053af1
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1007ada0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ef1
mov esp, ebp
pop ebp
ret
call fcn.10129e39
call fcn.10129e39
int3