joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002a038
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1003e01c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x1003e01c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x100178ea
cmp byte [edi + 0x45], 0
je 0x100178ea
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x100177f0
xor al, al
jmp 0x100178ec
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
lea esi, [edi + 0x48]
lea ebx, [ebx]
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp ebx, 0x10
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x10017871
dec eax
je 0x10017875
sub eax, 2
je 0x100178d0
xor bl, bl
jmp 0x100178d2
mov byte [edi + 0x45], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ebx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub esi, eax
je 0x100178ad
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x1001786d
cmp byte [edi + 0x45], 0
je 0x100178d0
test esi, esi
lea esi, [edi + 0x48]
jne 0x10017830
push 0
push 8
lea ecx, [esp + 0x20]
call fcn.100082c0
jmp 0x10017827
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x100178e6
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
jmp 0x100178ec
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1002769f
mov esp, ebp
pop ebp
ret
Function at 0x10018f50
Capabilities:
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x10033384
push 0
push str.HideEffect
push 0x10033318
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10018f91
cmp dword [ebp - 4], 0
jle 0x10018f8f
push 0x1003330c
push str.c3effect
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 8], eax
jmp 0x10018fa1
push 0x1003332c
push str.c3_backup
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str..config.ini
push 0
push 0x10033430
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0xc], eax
push 0x100333ac
push 0
push str.HpBar
push 0x100333e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x100445ec], eax
push 0x100333c8
push 0
push str.ShiftJump
push str.Character
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x10076bb4], eax
mov esp, ebp
pop ebp
ret

Function at 0x10019270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, edx
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
and ebx, 0x1f
push edi
mov edi, dword [ebp + 8]
cmp ebx, 8
jb 0x10019319
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xc], eax
jmp 0x100192a0
movq xmm0, qword [ecx]
push 0xc2b2ae3d
push 0x27d4eb4f
movq qword [ebp - 0x14], xmm0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.100282a0
add dword [ebp - 8], 8
mov ecx, eax
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.100282a0
mov ecx, eax
xor edx, esi
xor ecx, edi
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.100282a0
mov ecx, dword [ebp - 8]
mov edi, eax
add edi, 0xc2b2ae63
mov esi, edx
adc esi, 0x85ebca77
sub ebx, 8
dec dword [ebp - 0xc]
jne 0x100192a0
cmp ebx, 4
jb 0x1001936c
mov eax, dword [ecx]
add ecx, 4
push 0x9e3779b1
push 0x85ebca87
push 0
push eax
mov dword [ebp - 8], ecx
call fcn.100282a0
mov ecx, eax
xor edx, esi
xor ecx, edi
mov eax, ecx
push 0xc2b2ae3d
shld eax, edx, 0x17
shld edx, ecx, 0x17
push 0x27d4eb4f
push edx
push eax
call fcn.100282a0
mov edi, eax
mov esi, edx
add edi, 0x9e3779f9
adc esi, 0x165667b1
sub ebx, 4
test ebx, ebx
je 0x100193b1
mov eax, dword [ebp - 8]
push 0x27d4eb2f
push 0x165667c5
movzx eax, byte [eax]
cdq
push edx
push eax
call fcn.100282a0
inc dword [ebp - 8]
xor edi, eax
xor esi, edx
mov eax, edi
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, edi, 0xb
push esi
push eax
call fcn.100282a0
mov edi, eax
mov esi, edx
dec ebx
jne 0x10019370
push 0xc2b2ae3d
xor ecx, ecx
mov edx, esi
push 0x27d4eb4f
shr edx, 1
xor ecx, esi
xor edx, edi
push ecx
push edx
call fcn.100282a0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.100282a0
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d340
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.MSVCR120.dll_malloc]
push edi
push 0x12
mov dword [ebp - 8], 0x288
call esi
push 0x288
mov ebx, eax
call esi
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001d39e
push 0x10033b34
call dword [sym.imp.MSVCR120.dll_printf]
push ebx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002769f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1001d3ec
push edi
call dword [sym.imp.MSVCR120.dll_free]
push dword [ebp - 8]
call esi
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001d3ec
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call dword [sym.imp.MSVCR120.dll_printf]
mov eax, dword [sym.imp.MSVCR120.dll_free]
push ebx
call eax
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002769f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1001d463
mov esi, edi
lea ecx, [ecx]
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
push ebx
call dword [sym.imp.MSVCR120.dll_sprintf]
push ebx
lea eax, [esi + 0x1b0]
push eax
push str.Address:__s__mac:__s_n
call dword [sym.imp.MSVCR120.dll_printf]
push 0x10033aec
call dword [sym.imp.MSVCR120.dll_printf]
mov esi, dword [esi]
add esp, 0x30
test esi, esi
jne 0x1001d400
mov eax, dword [sym.imp.MSVCR120.dll_free]
push edi
call eax
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1002769f
mov esp, ebp
pop ebp
ret
Function at 0x1001e260
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a528
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10044a84]
test eax, eax
jne 0x1001e3a1
push eax
xorps xmm0, xmm0
push 4
movq qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x14], 0
call fcn.1001e4b0
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x18]
cmp ebx, 0xffffffff
jne 0x1001e2fe
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x1002c8e2
push eax
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVCR120.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x1003a3d4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push eax
call sub.MSVCR120.dll__CxxThrowException
mov dword [ebp - 0x34], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov edi, dword [0x10044a84]
test edi, edi
jne 0x1001e36c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esp, [esp]
test eax, eax
je 0x1001e36c
call esi
cmp eax, 0x12
je 0x1001e366
mov ecx, dword [ebp - 0x38]
mov eax, dword [0x10044a84]
cmp dword [ebp - 0x28], ecx
cmove eax, dword [ebp - 0x2c]
mov dword [0x10044a84], eax
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov edi, dword [0x10044a84]
test edi, edi
je 0x1001e330
jmp 0x1001e36c
mov edi, dword [0x10044a84]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1001e39f
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x1001e39f
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x1001e39f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002769f
mov esp, ebp
pop ebp
ret
Function at 0x1001e690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
mov edi, 0x400
mov eax, edi
mov dword [ebp - 8], edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1001e750
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftUsers_
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e750
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.ShellIntegration
push dword [ebp - 0xc]
call ebx
cmp eax, 0xea
jne 0x1001e742
add edi, 0x400
push edi
push esi
call dword [sym.imp.MSVCR120.dll_realloc]
add esp, 8
mov dword [ebp - 8], edi
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.ShellIntegration
push dword [ebp - 0xc]
call ebx
cmp eax, 0xea
je 0x1001e712
pop ebx
push dword [ebp - 0xc]
test eax, eax
je 0x1001e762
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002769f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002769f
mov esp, ebp
pop ebp
ret
Function at 0x1001e890
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10044a8c], 0
push esi
jne 0x1001ea79
call fcn.1001d490
call fcn.1001dcf0
call fcn.1001dd90
mov dword [0x10044a8c], 1
call fcn.1001d340
mov dword [0x10044a88], eax
lea eax, [ebp - 0x204]
push eax
push ecx
mov dword [ebp - 0x204], 0
call fcn.1001e690
add esp, 8
cmp eax, 1
je 0x1001e9a6
push 0x10044868
push 0x10034140
lea eax, [ebp - 0x200]
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
call fcn.1001e5d0
lea ecx, [ebp - 0x200]
call fcn.1001e790
lea eax, [ebp - 0x204]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftUsers_
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e985
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x200]
push eax
push 1
push 0
push 0x10034240
push dword [ebp - 0x204]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x204]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x200]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e990
sub ecx, edx
lea eax, [ebp - 0x200]
push ecx
push eax
jmp 0x1001ea6b
mov esi, dword [ebp - 0x204]
mov ecx, esi
call fcn.1001e810
push 0xa
push esi
push 0x10034140
call dword [sym.imp.MSVCR120.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x1001ea53
push 0x10044868
push 0x10034140
lea eax, [ebp - 0x200]
push 0x10034264
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
call fcn.1001e5d0
lea ecx, [ebp - 0x200]
call fcn.1001e790
lea eax, [ebp - 0x204]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftUsers_
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001ea37
lea eax, [ebp - 0x204]
mov ecx, 0x10034150
push eax
lea edx, [ebp - 0x200]
call fcn.1001e640
add esp, 4
lea ecx, [ebp - 0x200]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ea40
sub ecx, edx
lea eax, [ebp - 0x200]
push ecx
push eax
jmp 0x1001ea6b
mov ecx, esi
call fcn.1001e790
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ea60
sub ecx, edx
push ecx
push esi
push 0x10044868
call dword [sym.imp.MSVCR120.dll_strncpy]
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002769f
mov esp, ebp
pop ebp
ret
Function at 0x1001f450
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x1001f485
movdqu xmm0, xmmword [0x10034510]
mov eax, dword [0x10034528]
lea edx, [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, str.Conquer.exe
mov eax, dword [0x100344f0]
movdqu xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
movq xmm0, qword [0x10034520]
movq qword [ebp - 0x40], xmm0
movdqu xmm0, xmmword [str.x____x____xxxxxxxxxxxxxxxxx]
push eax
movdqu xmmword [ebp - 0x30], xmm0
movq xmm0, qword [0x100344e8]
movq qword [ebp - 0x20], xmm0
call fcn.1000f750
add esp, 4
mov dword [0x10044a98], eax
mov dword [0x10044a94], eax
call fcn.100260b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10026580
push fcn.1001ea90
push 0x10044a98
call fcn.10025b40
call fcn.10026110
test eax, eax
je 0x1001f518
push 0
call dword [sym.imp.MSVCR120.dll_exit]
jmp 0x1001f52a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002769f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001f850
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16a4
call fcn.100281b0
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea eax, [ebp - 0x1684]
push eax
push 0x1000
lea eax, [ebp - 0x1680]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1001f9af
xor esi, esi
test dword [ebp - 0x1684], 0xfffffffc
jbe 0x1001f9af
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
lea esp, [esp]
push 0x104
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp + esi*4 - 0x1680]
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1001f99d
lea eax, [ebp - 0x2f8]
lea edx, [eax + 2]
jmp 0x1001f8e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001f8e0
sub eax, edx
sar eax, 1
inc eax
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.MSVCR120.dll_wcstombs]
add esp, 0xc
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.1001a0b0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xf0]
push eax
sub esp, 0x18
mov ecx, esp
push 8
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x10034778
mov byte [ecx], 0
call fcn.100039d0
lea ecx, [ebp - 0x16a0]
call fcn.10019f40
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x1001f959
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp dword [ebp - 0x168c], 0x10
jb 0x1001f97e
push dword [ebp - 0x16a0]
call ebx
add esp, 4
lea eax, [ebp - 0x680]
mov edx, 6
push eax
call fcn.10007d60
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1684]
inc esi
shr eax, 2
cmp esi, eax
jb 0x1001f8b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002769f
mov esp, ebp
pop ebp
ret
Function at 0x100212b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12fc
call fcn.100281b0
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1003e174]
push ebx
mov ebx, dword [0x1005e4f0]
push esi
push edi
test eax, eax
je 0x100213e6
xor edi, edi
test ebx, ebx
jle 0x10021312
mov esi, 0x1005e4f8
test eax, eax
je 0x10021312
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1001a0b0
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1001f5e0
inc edi
add esi, 0xc8
cmp edi, ebx
jge 0x10021312
mov eax, dword [0x1003e174]
jmp 0x100212e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [0x1003e174], 0
mov edi, eax
je 0x100213d5
lea eax, [ebp - 0x12fc]
push eax
push 0x1000
lea eax, [ebp - 0x12f8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100213d5
xor esi, esi
test dword [ebp - 0x12fc], 0xfffffffc
jbe 0x100213d5
mov ebx, dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
lea ecx, [ecx]
push 0x104
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp + esi*4 - 0x12f8]
push edi
call ebx
test eax, eax
je 0x100213c7
lea eax, [ebp - 0x2f8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10021383
sub eax, edx
sar eax, 1
inc eax
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.MSVCR120.dll_wcstombs]
add esp, 0xc
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.1001a0b0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.1001f5e0
mov eax, dword [ebp - 0x12fc]
inc esi
shr eax, 2
cmp esi, eax
jb 0x10021360
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1003e174], 0
cmp dword [0x1003e170], 0
je 0x100213fe
call fcn.1001f9d0
mov dword [0x1003e170], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002769f
mov esp, ebp
pop ebp
ret

Function at 0x10022060
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x10022095
movdqu xmm0, xmmword [0x1003498c]
lea eax, [ebp - 0x20]
mov ecx, str.Conquer.exe
push eax
movdqu xmmword [ebp - 0x30], xmm0
lea edx, [ebp - 0x30]
movdqu xmm0, xmmword [str.xxxxxxxxx____xx]
movdqu xmmword [ebp - 0x20], xmm0
call fcn.1000f750
add esp, 4
mov dword [0x10076ba4], eax
mov dword [0x10076b9c], eax
call fcn.100260b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10026580
push 0x10021da0
push 0x10076ba4
call fcn.10025b40
call fcn.10026110
test eax, eax
je 0x100220fe
push 0
call dword [sym.imp.MSVCR120.dll_exit]
movdqu xmm0, xmmword [0x100349f0]
lea eax, [ebp - 0x30]
mov ecx, str.Conquer.exe
push eax
movdqu xmmword [ebp - 0x20], xmm0
lea edx, [ebp - 0x20]
movdqu xmm0, xmmword [str.x____xxxxxxxxxx]
movdqu xmmword [ebp - 0x30], xmm0
call fcn.1000f750
add esp, 4
mov dword [0x10076b98], eax
jmp 0x10022143
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002769f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10022240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [0x10034c98]
movzx eax, word [0x10034ca8]
lea edx, [ebp - 0x50]
mov word [ebp - 0x40], ax
mov ecx, str.Conquer.exe
movzx eax, word [0x10034c94]
movdqu xmmword [ebp - 0x50], xmm0
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
movdqu xmm0, xmmword [str.xx____xx____x____]
push edi
push eax
movdqu xmmword [ebp - 0x30], xmm0
call fcn.1000f750
add esp, 4
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x54]
mov dword [0x10076bac], eax
mov edi, 0x10022310
mov dword [0x10076bb0], eax
sub edi, eax
mov dword [ebp - 0x54], 0
push ecx
push 0x40
push 0xc
push eax
sub edi, 5
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x58]
mov ecx, 0x90909090
mov byte [eax], 0xe8
mov dword [eax + 1], edi
mov dword [eax + 5], ecx
mov word [eax + 9], cx
mov byte [eax + 0xb], cl
lea ecx, [ebp - 0x54]
push ecx
push dword [ebp - 0x54]
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1002769f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x10022620
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x10022655
movdqu xmm0, xmmword [0x10034e50]
lea eax, [ebp - 0x20]
mov ecx, str.Conquer.exe
push eax
movdqu xmmword [ebp - 0x30], xmm0
lea edx, [ebp - 0x30]
movdqu xmm0, xmmword [0x10034e40]
movdqu xmmword [ebp - 0x20], xmm0
call fcn.1000f750
add esp, 4
mov dword [0x10076bb8], eax
cmp dword [0x10076bb4], 0
mov dword [0x10076bbc], eax
je 0x100226c7
call fcn.100260b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10026580
push 0x100225e0
push 0x10076bb8
call fcn.10025b40
call fcn.10026110
test eax, eax
je 0x100226c7
push 0
call dword [sym.imp.MSVCR120.dll_exit]
jmp 0x100226d9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002769f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100228f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003e01c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x10034e6c
push str.MSVCRT.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x10076bc4]
mov edi, eax
mov ecx, edi
call fcn.1000f370
mov dword [0x10076bc4], eax
lea ecx, [eax + 5]
push ecx
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov ecx, dword [0x10076bc4]
add esp, 4
mov esi, eax
add ecx, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [0x10076bc4]
push edi
push esi
call sub.MSVCR120.dll_memcpy
mov eax, dword [0x10076bc4]
mov ecx, edi
sub ecx, esi
add esp, 0xc
sub ecx, 5
mov byte [eax + esi], 0xe9
mov eax, dword [0x10076bc4]
mov dword [eax + esi + 1], ecx
mov eax, 0x10022710
mov ecx, dword [ebp - 4]
sub eax, edi
sub eax, 5
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0xb], eax
xor ecx, ebp
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov al, byte [ebp - 8]
mov byte [edi + 4], al
pop edi
mov dword [0x10076bc0], esi
pop esi
call fcn.1002769f
mov esp, ebp
pop ebp
ret

Function at 0x100229b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
lea ecx, [ecx]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jl 0x100229d0
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 0xc