joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67e0e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x67e0f9
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b278
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x67e12d
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.0067dfac
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x67ffc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x680131
push dword fs:[eax]
mov dword fs:[eax], esp
test cl, cl
je 0x680015
mov eax, dword [0x6cfe20]
cmp dword [eax], 0xa0042ee
jae 0x680015
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x68009b
mov eax, 0x68014c
call fcn.0061674c
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x68009b
test cl, cl
je 0x680020
mov esi, 0x80000001
jmp 0x680025
mov esi, 0x80000002
push 0
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x6cfcfc]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x6cf310]
mov edx, esi
xor eax, eax
call fcn.005c7a60
test eax, eax
jne 0x680091
mov esi, ebx
test esi, esi
je 0x680054
sub esi, 4
mov esi, dword [esi]
inc esi
mov eax, esi
add eax, eax
push eax
mov eax, ebx
call fcn.0040b278
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x680086
mov eax, 0x680228
call fcn.0061674c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x68009b
mov eax, 0x68028c
call fcn.0061674c
cmp byte [ebp + 0xc], 0
je 0x680116
mov eax, ebx
call fcn.0040b278
push eax
call fcn.00414408
test eax, eax
je 0x6800c4
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
jmp 0x680116
lea ecx, [ebp - 0x10]
mov edx, 0x6802e0
mov ax, 0x47
call fcn.005cd844
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.005c8430
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x6cff50]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6cff50]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6cff50]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
pop eax
call fcn.0067d568
test al, al
je 0x6800a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680138
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040a228
ret
Function at 0x6a7418
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6a74e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x6a6ab8]
call fcn.006a7510
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a74c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x6a7500
call fcn.00424510
mov edx, dword [ebp - 8]
mov eax, dword [0x6cff3c]
mov eax, dword [eax]
call fcn.005b8268
call fcn.006a6ce4
call sub.user32.dll_GetFocus
mov edx, dword [0x6cff3c]
mov edx, dword [edx]
cmp eax, dword [edx + 0x188]
jne 0x6a74a3
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x6a74aa
call sub.user32.dll_WaitMessage
jmp 0x6a747d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a74c7
mov eax, dword [ebp - 4]
call fcn.00408444
ret

Function at 0x6ad9a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6ad9a8
push ecx
push ebx
xor eax, eax
push ebp
push 0x6adaf6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0060db4c
mov edx, dword [ebp - 0x10]
mov eax, 0x6d853c
call fcn.0040a5a8
lea eax, [ebp - 0x14]
mov ecx, dword [0x6d853c]
mov edx, 0x6adb10
call fcn.0040b4c8
mov eax, dword [ebp - 0x14]
call fcn.0061674c
mov eax, dword [0x6d0054]
cmp byte [eax], 0
je 0x6ada03
mov eax, dword [0x6d853c]
call fcn.00615e58
lea edx, [ebp - 0x18]
mov eax, dword [0x6d853c]
call fcn.005c4ebc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x6adb58
call fcn.0040b4c8
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x6ada9d
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov ax, 0x3d
call fcn.005cd844
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00423044
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.005c86b0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov ax, 0x81
call fcn.005cd814
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41baa4]
call fcn.00429020
call fcn.004098c4
lea eax, [ebp - 8]
call fcn.00625b68
cmp dword [ebp - 8], 0
je 0x6adace
lea eax, [ebp - 0xc]
mov ecx, 0x6adb74
mov edx, dword [ebp - 4]
call fcn.0040b4c8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006ad948
mov eax, dword [ebp - 0xc]
call fcn.00625bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6adafd
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040a228
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040a228
ret
Function at 0x6b066c
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x6d8831], 1
call fcn.0060fcf4
test al, al
jne 0x6b06be
push 5
mov eax, dword [0x6cff3c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x6cff3c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x6cff50]
mov eax, dword [eax + 0x15c]
mov cl, 2
xor edx, edx
call fcn.006b037c
ret

Function at 0x6b4020
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x6b4045
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6b5e78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x6b5ea4
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x6b5ead
call fcn.006b4ab8
mov eax, 0xa
call fcn.005c8ccc
call fcn.006b4ab8
call fcn.006b5e44
test al, al
jne 0x6b5e82
pop ebx
ret
Function at 0x10008c30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10008c5c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10008c7e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10008c80
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10008d05
jg 0x10008c95
test esi, esi
je 0x10008d05
test ecx, ecx
jl 0x10008cde
jg 0x10008c9f
test eax, eax
je 0x10008cde
cmp edi, ecx
jg 0x10008cb3
jl 0x10008ca9
cmp esi, eax
jae 0x10008cb3
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10008ce1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10008d05
jg 0x10008ceb
test esi, esi
je 0x10008d05
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10008d05
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10008d4c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x10008d6e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10008d70
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x10008e10
jg 0x10008d8d
test esi, esi
je 0x10008e10
test ecx, ecx
jl 0x10008dda
jg 0x10008d97
test eax, eax
je 0x10008dda
cmp ebx, ecx
jg 0x10008dab
jl 0x10008da1
cmp esi, eax
jae 0x10008dab
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10008de1
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x10008e10
jg 0x10008deb
test esi, esi
je 0x10008e10
cmp dword [edi + 0x4c], 0
je 0x10008e10
mov ecx, edi
call fcn.100095d0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101c6014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10009190
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325d8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100091c0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100091c0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325d8
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10009295
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100091e9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100091f5
movsx eax, bl
jmp 0x1000922c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10009295
cmp eax, 1
jle 0x10009256
cmp eax, 3
jne 0x10009295
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325d8
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10009274
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10009295
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10009295
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325d8
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100325d8
mov esp, ebp
pop ebp
ret 4
Function at 0x10009600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101c6014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x100096a3
cmp byte [esi + 0x3d], 0
je 0x100096a3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10009658
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000966a
sub eax, 1
je 0x1000966e
sub eax, 2
je 0x100096a3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325d8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000968c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10009658
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325d8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100325d8
mov esp, ebp
pop ebp
ret
Function at 0x10014270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x101c7724]
push ebx
push esi
push edi
mov eax, dword [ecx]
push 0xff
push 0x3c
push 0x3c
push 0x3c
call dword [eax + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [0x101c7724]
lea ebx, [esi + 0x12]
lea eax, [ebx + 2]
mov edx, dword [ecx]
push eax
lea eax, [edi + 0xe8]
push eax
lea eax, [esi - 2]
push eax
lea eax, [edi - 2]
push eax
call dword [edx + 0x28]
mov byte [ebp + 0xf], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101c6f30]
cmp eax, 0xc8
jbe 0x10014356
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101c6f34]
cmp eax, 0xc8
jbe 0x10014356
cmp byte [0x101c6f3d], 0
jne 0x10014356
cmp byte [0x101c6f3c], 0
jne 0x10014356
cmp byte [0x101c6f4a], 0
je 0x10014356
cmp byte [0x101c6e19], 0
lea eax, [edi + 0xe6]
jne 0x1001435c
mov ecx, dword [0x101c6e28]
cmp ecx, edi
jl 0x1001435c
cmp ecx, eax
ja 0x1001435c
mov ecx, dword [0x101c6e2c]
cmp ecx, esi
jl 0x1001435c
cmp ecx, ebx
ja 0x1001435c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101e80c4]
cmp eax, 0xc8
jbe 0x10014356
mov byte [ebp + 0xf], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xff
push 0x3c
push 0x3c
mov dword [0x101e80c4], eax
push 0x3c
jmp 0x1001438f
lea eax, [edi + 0xe6]
mov ecx, dword [0x101c6e28]
cmp ecx, edi
jl 0x10014384
cmp ecx, eax
ja 0x10014384
mov eax, dword [0x101c6e2c]
cmp eax, esi
jl 0x10014384
cmp eax, ebx
ja 0x10014384
push 0xff
push 0x3c
push 0x3c
push 0x3c
jmp 0x1001438f
push 0xff
push 0x1a
push 0x1a
push 0x14
mov ecx, dword [0x101c7724]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [0x101c7724]
lea edx, [edi + 0xe6]
push ebx
push edx
push esi
mov eax, dword [ecx]
push edi
call dword [eax + 0x24]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100143e8
push eax
push 2
push 0xff
push 0xdc
push 0xdc
push 0xdc
lea ecx, [esi + 9]
push ecx
lea ecx, [edi + 0x73]
push ecx
push dword [0x101c6df8]
push 0x101c6dfc
call fcn.1000cc80
add esp, 0x28
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10015ae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x101c7724]
push ebx
push esi
push edi
mov eax, dword [ecx]
push 0xff
push 0x64
push 0x63
push 0x5b
call dword [eax + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [0x101c7724]
lea edx, [esi + 0xa]
push edx
mov eax, dword [ecx]
lea ebx, [edi + 0xa]
push ebx
push esi
push edi
call dword [eax + 0x28]
mov ecx, dword [0x101c7724]
push 0xff
push 0
push 0
mov eax, dword [ecx]
push 0
call dword [eax + 0x20]
mov ecx, dword [0x101c7724]
lea eax, [esi + 0xb]
push eax
lea eax, [edi + 0xb]
push eax
mov edx, dword [ecx]
lea eax, [esi - 1]
push eax
lea eax, [edi - 1]
push eax
call dword [edx + 0x28]
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10015b96
vcvttss2si eax, dword [0x101c7ac8]
mov ecx, dword [0x101c7724]
push 0xff
push eax
vcvttss2si eax, dword [0x101c7ac4]
mov edx, dword [ecx]
push eax
vcvttss2si eax, dword [0x101c7ac0]
push eax
call dword [edx + 0x20]
mov ecx, dword [0x101c7724]
lea eax, [esi + 9]
push eax
lea eax, [edi + 9]
push eax
mov edx, dword [ecx]
lea eax, [esi + 1]
push eax
lea eax, [edi + 1]
push eax
call dword [edx + 0x24]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10015bcf
push eax
push 0
push 0xff
push 0xb4
push 0xb4
push 0xb4
lea eax, [esi + 4]
push eax
lea eax, [edi + 0x10]
push eax
push dword [0x101c6df8]
push 0x101c6dfc
call fcn.1000cc80
add esp, 0x28
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x101c6f2c]
cmp eax, 0xc8
jbe 0x10015c3a
cmp byte [0x101c6f3d], 0
jne 0x10015c3a
cmp byte [0x101c6f3c], 0
jne 0x10015c3a
cmp byte [0x101c6f4a], 0
je 0x10015c3a
cmp byte [0x101c6e19], 0
jne 0x10015c3a
mov eax, dword [0x101c6e28]
cmp eax, edi
jl 0x10015c3a
lea ecx, [edi + 0xa]
cmp eax, ecx
ja 0x10015c3a
mov eax, dword [0x101c6e2c]
cmp eax, esi
jl 0x10015c3a
lea ecx, [esi + 0xa]
cmp eax, ecx
ja 0x10015c3a
mov ecx, dword [ebp + 0x10]
cmp byte [ecx], 0
sete al
mov byte [ecx], al
call ebx
mov dword [0x101c6f2c], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x10021d60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x101c704c]
mov ebx, ecx
cmp dword [esi + 0x18], 0
push edi
lea edi, [esi + 0x18]
mov dword [ebp - 4], edx
je 0x10021db9
nop dword [eax + eax]
mov eax, ebx
lea ecx, [esi + 8]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10021da5
test dl, dl
je 0x10021da1
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10021da5
add ecx, 2
add eax, 2
test dl, dl
jne 0x10021d85
xor eax, eax
jmp 0x10021daa
sbb eax, eax
or eax, 1
test eax, eax
je 0x10021dc0
mov esi, dword [edi]
cmp dword [esi + 0x18], 0
lea edi, [esi + 0x18]
jne 0x10021d80
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10021dd4
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x1c], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
push str.FATAL_ERROR
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002eef0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1002ef5c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x104
push 0x101c617c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x101c617c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002ef20
sub ecx, edx
lea eax, [ecx + 0x101c617c]
cmp eax, 0x101c617c
jb 0x1002ef43
cmp byte [eax], 0x5c
je 0x1002ef43
dec eax
cmp eax, 0x101c617c
jae 0x1002ef36
push 0
push 0
push 0
push 0x1002e5d0
push 0
push 0
mov byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1002ef70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101c6014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x101e8178], 0
jne 0x1002f08f
push esi
push edi
push str.cl_updaterate_minimum_is__f
push dword [0x101c7864]
push dword [0x101c785c]
call fcn.1002f140
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax - 0x18]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x101c0500]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
push str.cl_updaterate_maximum_is__f
push dword [0x101c7864]
push dword [0x101c785c]
call fcn.1002f140
lea esi, [eax - 0x18]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
movzx ecx, byte [0x101c0500]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [esi], cl
push 1
push esi
call edi
push str.ex_interp_forced_up_to__i_msec_n
push dword [0x101c7864]
push dword [0x101c785c]
call fcn.1002f140
push ecx
push eax
add eax, 0xfffffff7
push eax
push 0x101c0170
call fcn.1002f280
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
movzx ecx, byte [0x101c0500]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [esi], cl
push 1
push esi
call edi
push str.ex_interp_forced_down_to__i_msec_n
push dword [0x101c7864]
push dword [0x101c785c]
call fcn.1002f140
lea esi, [eax - 5]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
movzx ecx, byte [0x101c0500]
lea eax, [ebp - 8]
mov byte [esi], cl
push eax
push dword [ebp - 8]
push 1
push esi
call edi
pop edi
mov byte [0x101e8178], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325d8
mov esp, ebp
pop ebp
ret

Function at 0x100304d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10030680
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1003059d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003051a
mov eax, dword [ebp - 4]
cmp eax, dword [0x101c6004]
ja 0x1003051a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100304ea
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10030540
jmp 0x1003059d
cmp dword [ebp - 0x14], 0x10000
jne 0x10030583
cmp dword [ebp - 0x18], 0x10000
jb 0x10030583
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10030576
mov eax, dword [ebp - 8]
jmp 0x1003059f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10030598
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10030680
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100304ea
xor eax, eax
mov esp, ebp
pop ebp
ret