joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b910
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001b93a
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
push edi
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x1001b979
push ebx
call esi
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 0x3c]
push 4
push 0x1000
push dword [eax + edi + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x1001b9c6
push dword [ebp + 0xc]
push esi
push edi
call fcn.1001b9e0
add esp, 0xc
test eax, eax
je 0x1001b9b6
push dword [ebp + 0xc]
push esi
call fcn.1001b5c0
add esp, 8
test eax, eax
jne 0x1001b9c6
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x1001cc40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
test esi, esi
jne 0x1001cc73
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x1001cc87
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov ecx, eax
mov dword [ebp - 0x50], ecx
jne 0x1001ccbd
push 0x1f4
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x50]
test eax, eax
jne 0x1001cccb
cmp dword [esi + 0xc], 0
jle 0x1001cccb
mov eax, dword [esi + 4]
mov esi, dword [eax + 0x24]
jmp 0x1001cccd
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
Function at 0x1001cd00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], 0
test edi, edi
jne 0x1001cd38
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x1001cd4c
push edi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
jne 0x1001cd7a
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
mov esi, dword [ebx]
xor edx, edx
push eax
mov ecx, dword [esi + 0x24]
cmp ecx, dword [edi + 8]
cmove ecx, edx
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d040
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b247d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0
test ebx, ebx
jne 0x1001d093
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x1001d0a7
push ebx
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x1001d0e3
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x58], ecx
test eax, eax
je 0x1001d0e3
xor edi, edi
jmp 0x1001d11a
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x1001d11a
nop word [eax + eax]
push esi
mov ecx, ebx
call fcn.1001e1b0
mov ecx, dword [ebx + 8]
mov esi, eax
push ecx
push esi
push dword [ecx + 0x20]
mov ecx, ebx
call fcn.1001e1d0
inc dword [ebx + 0xc]
test edi, edi
cmove edi, esi
sub dword [ebp + 0xc], 1
mov esi, dword [ebp - 0x60]
jne 0x1001d0f0
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 8
Function at 0x1001de60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b24bd
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x58], 0
lea eax, [ebp - 0x54]
test esi, esi
jne 0x1001dead
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x1001dec1
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x1001defd
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x58], ecx
test eax, eax
je 0x1001defd
xor edi, edi
jmp 0x1001df29
mov ebx, dword [ebp + 8]
cmp ebx, dword [esi + 0xc]
cmovge ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x1001df29
nop dword [eax]
mov eax, dword [esi + 4]
mov ecx, esi
push dword [eax + 0x24]
call fcn.1001e1f0
test eax, eax
je 0x1001df29
dec dword [esi + 0xc]
inc edi
cmp edi, ebx
jl 0x1001df10
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4

Function at 0x100205a0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x100205cc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4
movzx eax, word [0x100ba7fc]
mov word [ebp - 0x10], ax
mov al, byte [0x100ba7fe]
push ebx
mov byte [ebp - 0xe], al
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0xc]
mov byte [ebp - 0xc], 0
push eax
mov dword [ebp - 0xb], 0
call dword [sym.imp.USER32.dll_CharToOemA]
movsx eax, byte [ebp - 0x10]
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_OemKeyScan]
mov ebx, dword [ebp + 8]
push 0
push ebx
movzx edi, al
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov eax, edi
or eax, 1
push eax
push ebx
push 0x100
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x10020662
or edi, 0xc0000001
push edi
push ebx
push 0x101
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x10020662
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4
Function at 0x10022ad0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
push esi
push edi
test ebx, ebx
jne 0x10022b05
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10022b19
push ebx
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov edi, eax
mov dword [ebp - 0x50], edi
jne 0x10022b4f
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp - 0x50]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x4c], ecx
test eax, eax
jne 0x10022b7a
mov eax, dword [ebx + 4]
mov ebx, dword [ebx + 8]
mov esi, dword [eax + 0x440c]
cmp esi, ebx
je 0x10022b7a
nop
push dword [ebp + 8]
push esi
call fcn.10023590
add esp, 8
test eax, eax
jne 0x10022b7c
mov esi, dword [esi + 0x440c]
cmp esi, ebx
jne 0x10022b60
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4

Function at 0x10022bb0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
test esi, esi
jne 0x10022be3
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10022bf7
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov ecx, eax
mov dword [ebp - 0x50], ecx
jne 0x10022c2d
push 0x1f4
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x50]
test eax, eax
jne 0x10022c3e
cmp dword [esi + 0xc], 0
jle 0x10022c3e
mov eax, dword [esi + 4]
mov esi, dword [eax + 0x440c]
jmp 0x10022c40
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
Function at 0x10022c70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], 0
test edi, edi
jne 0x10022ca8
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10022cbc
push edi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
jne 0x10022cea
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
mov esi, dword [ebx]
xor edx, edx
push eax
mov ecx, dword [esi + 0x440c]
cmp ecx, dword [edi + 8]
cmove ecx, edx
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4

Function at 0x10022d30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b254d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0
test edi, edi
jne 0x10022d83
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10022d97
push edi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x10022dd3
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x58], ecx
test eax, eax
je 0x10022dd3
xor esi, esi
jmp 0x10022e10
cmp dword [ebp + 0xc], 0
mov ebx, dword [edi + 4]
jle 0x10022e07
nop dword [eax]
push esi
mov ecx, edi
call fcn.10023520
push dword [ebx + 0x440c]
mov esi, eax
mov ecx, edi
push esi
push ebx
call fcn.100235a0
inc dword [edi + 0xc]
mov ebx, esi
sub dword [ebp + 0xc], 1
mov esi, dword [ebp - 0x60]
jne 0x10022de0
mov eax, dword [edi + 4]
mov esi, dword [eax + 0x440c]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 8
Function at 0x10022e50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b258d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0
test ebx, ebx
jne 0x10022ea3
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10022eb7
push ebx
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x10022ef3
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x58], ecx
test eax, eax
je 0x10022ef3
xor edi, edi
jmp 0x10022f2d
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x10022f2d
nop word [eax + eax]
push esi
mov ecx, ebx
call fcn.10023520
mov ecx, dword [ebx + 8]
mov esi, eax
push ecx
push esi
push dword [ecx + 0x4408]
mov ecx, ebx
call fcn.100235a0
inc dword [ebx + 0xc]
test edi, edi
cmove edi, esi
sub dword [ebp + 0xc], 1
mov esi, dword [ebp - 0x60]
jne 0x10022f00
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 8
Function at 0x10023040
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b25cd
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], 0
test esi, esi
jne 0x10023093
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x100230a7
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x100230df
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x58], ecx
test eax, eax
jne 0x10023121
mov ebx, dword [ebx]
mov ecx, esi
push ebx
call fcn.10023550
test eax, eax
je 0x10023121
mov eax, dword [ebp + 0xc]
sub eax, 1
je 0x10023106
sub eax, 1
je 0x100230fe
xor edi, edi
jmp 0x1002310c
mov edi, dword [ebx + 0x440c]
jmp 0x1002310c
mov edi, dword [ebx + 0x4408]
push ebx
mov ecx, esi
call fcn.100235d0
test eax, eax
jne 0x1002315c
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
xor esi, esi
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 8
dec dword [esi + 0xc]
cmp edi, dword [esi + 4]
je 0x10023169
cmp edi, dword [esi + 8]
jne 0x1002316b
xor edi, edi
mov eax, dword [ebp - 0x60]
mov esi, 1
mov dword [eax], edi
jmp 0x10023123
Function at 0x10023230
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b260d
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x58], 0
lea eax, [ebp - 0x54]
test esi, esi
jne 0x1002327d
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10023291
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x100232cd
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x58], ecx
test eax, eax
je 0x100232cd
xor edi, edi
jmp 0x100232fc
mov ebx, dword [ebp + 8]
cmp ebx, dword [esi + 0xc]
cmovge ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x100232fc
nop dword [eax]
mov eax, dword [esi + 4]
mov ecx, esi
push dword [eax + 0x440c]
call fcn.100235d0
test eax, eax
je 0x100232fc
dec dword [esi + 0xc]
inc edi
cmp edi, ebx
jl 0x100232e0
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4

Function at 0x10023390
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push esi
mov esi, ecx
mov dword [ebp - 0x4c], 0
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x100233cb
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x100233df
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
jne 0x10023410
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
test eax, eax
sete dl
mov dword [ebp - 0x4c], edx
test eax, eax
jne 0x1002341c
push edi
mov ecx, esi
call fcn.10023550
test eax, eax
jne 0x10023420
xor esi, esi
jmp 0x10023434
push 0x4408
push ebx
push edi
call fcn.1004beb0
add esp, 0xc
mov esi, 1
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 8
Function at 0x1002653c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10026563
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10026566
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10026518
pop esi
leave
ret 8

Function at 0x10049375
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.1008a99f
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100493b4
sub eax, 1
je 0x100493af
sub eax, 1
je 0x100493ab
xor eax, eax
leave
ret
push 3
jmp 0x100493b6
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x10078cd2
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x100bf298
push esi
call fcn.100990c9
pop ecx
pop ecx
test eax, eax
jne 0x10078d00
xor al, al
jmp 0x10078d7d
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.1007892f
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x10078d3a
push dword [ebp - 0x210]
call fcn.1007b75b
xor al, al
jmp 0x10078d7b
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10078d40
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x10078d60
push edx
call fcn.10078c09
pop ecx
test al, al
je 0x10078d2b
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x10078d6e
mov bl, 1
push dword [ebp - 0x210]
call fcn.1007b75b
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10049f5b
leave
ret

Function at 0x1009076f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100907ae
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100907ae
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100907ae
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100907ae
cmp dword [ecx + 0x74], 0xe
jbe 0x100907ae
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1009773e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c1c3c
push 0x100c1c34
push str.FlsAlloc
push 0x1f
call fcn.1009740c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10097772
push dword [ebp + 8]
mov ecx, esi
call dword [0x100b628c]
call esi
jmp 0x10097778
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4