joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ccd0
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
push 0
push 0
push 0x1000cd00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000d4f0
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x10040cf8]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x100411b4], 1
jne 0x1000d530
push 0
push 0
push 0
push 0x1000d980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10026c20
add esp, 0x20
ret
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000d5d2
lea eax, [esp + 4]
push eax
push 0x1002ce9c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000d5d2
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000d5d2
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000d5d2
push 0
push 0
push 0
push 0x1000d0b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10026c20
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
xor ecx, esp
call fcn.10026c20
add esp, 0x20
ret
Function at 0x1000da00
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000e540
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1000e560
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1000e330
push 0
push 0
call esi
pop esi
ret

Function at 0x1000ef00
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002868b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040cf8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1004118c], 1
jne 0x1000ef9e
push 1
push 0x40
push 8
push 0x1002d634
lea ecx, [ebp - 0x174]
call fcn.100049c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nFTP_Server_connection_fail_
push eax
call fcn.10004550
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.100054a0
test eax, eax
jne 0x1000ef8c
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10004fb0
cmp dword [0x1004119c], 1
jne 0x1000f05f
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002d668
call fcn.100049c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1002d66c
push eax
call fcn.10004550
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push str.FTP_Server_connection_fail_
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x1002d698
push eax
call fcn.10004550
add esp, 0x24
lea ecx, [ebp - 0xc0]
call fcn.100054a0
test eax, eax
jne 0x1000f054
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0xc4]
call fcn.10004fb0
mov eax, dword [0x10041190]
cmp eax, 1
je 0x1000f0a0
cmp eax, 3
je 0x1000f0a0
cmp eax, 4
je 0x1000f0a0
push 0
cmp eax, 2
jne 0x1000f09a
push 0
push 0
push 0x1000f0b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000f0e0
jmp 0x1000f083
Function at 0x1000f110
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002868b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040cf8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1004118c], 1
jne 0x1000f1ae
push 1
push 0x40
push 8
push 0x1002d730
lea ecx, [ebp - 0x174]
call fcn.100049c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_HTTP_Server_connection_fail_
push eax
call fcn.10004550
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.100054a0
test eax, eax
jne 0x1000f19c
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10004fb0
cmp dword [0x1004119c], 1
jne 0x1000f26f
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002d764
call fcn.100049c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1002d768
push eax
call fcn.10004550
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x1002d778
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x1002d798
push eax
call fcn.10004550
add esp, 0x24
lea ecx, [ebp - 0xc0]
call fcn.100054a0
test eax, eax
jne 0x1000f264
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0xc4]
call fcn.10004fb0
mov eax, dword [0x10041190]
cmp eax, 1
je 0x1000f2b0
cmp eax, 3
je 0x1000f2b0
cmp eax, 4
je 0x1000f2b0
push 0
cmp eax, 2
jne 0x1000f2aa
push 0
push 0
push 0x1000f2c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000f2f0
jmp 0x1000f293

Function at 0x1000f320
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000f480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000f340
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028bc0
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x10040cf8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x80000000
push 0
push 0
push str.http:__icanhazip.com_
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x1000f46b
lea eax, [ebp - 0x44]
push eax
push 0x2f
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x44]
cmp eax, 0x2f
jae 0x1000f470
push 1
push 0x40
push 8
push 0x1002d818
lea ecx, [ebp - 0xf4]
mov byte [ebp + eax - 0x40], 0
call fcn.100049c0
lea eax, [ebp - 0xf4]
mov dword [ebp - 4], 0
push str._nPublic_IP:
push eax
call fcn.10004550
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.10004550
lea eax, [ebp - 0xf4]
push str._n_________Hack_Log___________n_n
push eax
call fcn.10004550
add esp, 0x18
lea ecx, [ebp - 0xf0]
call fcn.100054a0
test eax, eax
jne 0x1000f43a
push eax
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0xf4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.1000f6b0
lea ecx, [ebp - 0xf4]
call fcn.10004fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026c20
mov esp, ebp
pop ebp
ret
call fcn.1000f110
call fcn.10026dc0
int3
Function at 0x1000fca0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028ccb
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x10040cf8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x14
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1000fdf4
push 1
push 0x40
push 8
push 0x1002d888
lea ecx, [ebp - 0x1a0]
call fcn.100049c0
lea eax, [ebp - 0x1a0]
mov dword [ebp - 4], 0
push str._nComputer_Username:
push eax
call fcn.10004550
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.10004550
add esp, 0x10
lea ecx, [ebp - 0x19c]
call fcn.100054a0
test eax, eax
jne 0x1000fd52
push eax
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a0]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1000fde4
push 1
push 0x40
push 8
push 0x1002d868
lea ecx, [ebp - 0xf0]
call fcn.100049c0
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 1
push str._nComputer_Name:
push eax
call fcn.10004550
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.10004550
add esp, 0x10
lea ecx, [ebp - 0xec]
call fcn.100054a0
test eax, eax
jne 0x1000fdd2
push eax
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
call fcn.1000f340
lea ecx, [ebp - 0xf0]
call fcn.10004fb0
jmp 0x1000fde9
call fcn.1000f340
lea ecx, [ebp - 0x1a0]
call fcn.10004fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026c20
mov esp, ebp
pop ebp
ret
Function at 0x10010240
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x10041190]
cmp eax, 1
je 0x1001028c
cmp eax, 4
je 0x1001028c
push 0
cmp eax, 2
jne 0x1001027c
push 0
push 0
push 0x100102c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x10010276
push 0
push 0
push 0x10010320
jmp 0x1001025f
push 0
push 0
push 0
push 0x100102f0
jmp 0x1001025f

Function at 0x100102a0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10010150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10010350
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100410a4], 0xb7
jne 0x100103b5
mov eax, dword [0x10041190]
push 0x200030
push dword [0x1004110c]
cmp eax, 1
jne 0x10010386
push 0x1002e06c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x100103a0
push str.SI_Scan_n_nO_Sistema_Anti_kill_permite_apenas_uma_instancia_de_jogo_aberta_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.SI_Scan_n_nAnti_kill_active__just_one_Game_instance_allowed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x100103f0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100107e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x10010410
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x810
mov eax, dword [0x10040cf8]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push str.MyBrowser
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x1001058f
push 1
push 0
push 3
push 0
push 0
push 0x50
push dword [0x100410f8]
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
je 0x1001058f
push 1
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x1002e4d8
push eax
push 0
push 0
push str.Codex_ServerSideBan_Renew.php
push str.POST
push ebx
mov dword [esp + 0x34], 0
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x1001058f
mov ecx, str._____________________________og94kfkldjs7ekk_r_nContent_Disposition:_form_data__name_uploadedfile___filename_Log.txt__r_nContent_Type:_text_plain_r_n_r_nCodex_Anti_Hack_r_n_____________________________og94kfkldjs7ekk___r_n
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100104a7
sub ecx, edx
mov edx, str.Content_Type:_multipart_form_data__boundary___________________________og94kfkldjs7ekk
push ebp
lea ebp, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x100104c0
push ecx
push str._____________________________og94kfkldjs7ekk_r_nContent_Disposition:_form_data__name_uploadedfile___filename_Log.txt__r_nContent_Type:_text_plain_r_n_r_nCodex_Anti_Hack_r_n_____________________________og94kfkldjs7ekk___r_n
sub edx, ebp
push edx
push str.Content_Type:_multipart_form_data__boundary___________________________og94kfkldjs7ekk
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
pop ebp
test eax, eax
je 0x1001058f
push 0x800
lea eax, [esp + 0x1c]
push 0
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x800
lea eax, [esp + 0xc]
push 0
push eax
lea eax, [esp + 0x20]
push eax
push 0x16
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1001058f
push 0x1000d080
lea eax, [esp + 0x1c]
push eax
push dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.10004550
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x800
lea eax, [esp + 0x1c]
push 0
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x800
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1001058f
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push edi
call esi
mov ecx, dword [esp + 0x818]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10026c20
add esp, 0x810
ret
call fcn.100105a0
int3
Function at 0x100105a0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002868b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040cf8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1004118c], 1
jne 0x1001063e
push 1
push 0x40
push 8
push 0x1002e438
lea ecx, [ebp - 0x174]
call fcn.100049c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nHTTP_Server_connection_fail_
push eax
call fcn.10004550
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.100054a0
test eax, eax
jne 0x1001062c
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10004fb0
cmp dword [0x1004119c], 1
jne 0x1001070c
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002e46c
call fcn.100049c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1002e470
push eax
call fcn.10004550
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push str.HTTP_Server_connection_fail_
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x1002e4a0
push eax
call fcn.10004550
add esp, 0x24
lea ecx, [ebp - 0xc0]
call fcn.100054a0
test eax, eax
jne 0x100106f4
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x1002e4c8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10004fb0
mov eax, dword [0x10041190]
cmp eax, 1
je 0x1001074d
cmp eax, 3
je 0x1001074d
cmp eax, 4
je 0x1001074d
push 0
cmp eax, 2
jne 0x10010747
push 0
push 0
push 0x10010760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10010790
jmp 0x10010730

Function at 0x100107c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push fcn.10010410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10010810
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10010830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x10014e60
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10014fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x10015ba0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002868b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040cf8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1004118c], 1
jne 0x10015c4f
push 1
push 0x40
push 8
push 0x10030230
lea ecx, [ebp - 0x174]
call fcn.100049c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_HB___Load_data_fail:
push eax
call fcn.10004550
lea eax, [ebp - 0x174]
push 0x10030260
push eax
call fcn.10004550
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.100054a0
test eax, eax
jne 0x10015c3d
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10004fb0
cmp dword [0x1004119c], 1
jne 0x10015d2e
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x10030278
call fcn.100049c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1003027c
push eax
call fcn.10004550
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push str.HB___Load_data_fail:
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push str.Unable_to_load_data_
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x100302bc
push eax
call fcn.10004550
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.100054a0
test eax, eax
jne 0x10015d16
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x100302e4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10004fb0
mov eax, dword [0x10041190]
cmp eax, 1
je 0x10015d6f
cmp eax, 3
je 0x10015d6f
cmp eax, 4
je 0x10015d6f
push 0
cmp eax, 2
jne 0x10015d69
push 0
push 0
push 0x10015d80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10015db0
jmp 0x10015d52
Function at 0x10015de0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002868b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040cf8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1004118c], 1
jne 0x10015e7e
push 1
push 0x40
push 8
push 0x10030350
lea ecx, [ebp - 0x174]
call fcn.100049c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._n_HB___FTP_Server_connection_fail_
push eax
call fcn.10004550
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.100054a0
test eax, eax
jne 0x10015e6c
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10004fb0
cmp dword [0x1004119c], 1
jne 0x10015f4c
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x10030388
call fcn.100049c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1003038c
push eax
call fcn.10004550
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push str.HB___FTP_Server_connection_fail_
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x100303c0
push eax
call fcn.10004550
add esp, 0x24
lea ecx, [ebp - 0xc0]
call fcn.100054a0
test eax, eax
jne 0x10015f34
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x100303e8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10004fb0
mov eax, dword [0x10041190]
cmp eax, 1
je 0x10015f8d
cmp eax, 3
je 0x10015f8d
cmp eax, 4
je 0x10015f8d
push 0
cmp eax, 2
jne 0x10015f87
push 0
push 0
push 0x10015fa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10015fd0
jmp 0x10015f70