joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407252
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, 0x40e
push esi
mov edx, ebx
mov esi, ecx
call fcn.0040ae8b
cmp eax, 0xffffffff
jne 0x4072d5
push edi
mov edi, 0x80
lea eax, [ebp - 0x88]
push edi
push 0
push eax
call fcn.0041bccc
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
push edi
push 0xd
push ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
and dword [ebp - 8], 0
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push str.__d__c
push eax
call fcn.0041b50c
add esp, 0x10
pop edi
cmp eax, 1
jne 0x4072d5
mov ecx, dword [esi + 0x4c]
mov eax, dword [ebp - 8]
mov dword [ecx + 0xe9], eax
pop esi
pop ebx
leave
ret

Function at 0x407e5e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
lea ecx, [edi + 0xd8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
lea esi, [edi + 0x50]
mov dword [ebp - 8], ebx
call fcn.004019e0
test al, al
je 0x407eb0
mov ecx, dword [esi]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x36], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x3a], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x42], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x46], eax
lea eax, [ebp - 0x98]
push eax
push 0x80
push 0xd
push 0x3f2
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x98]
push eax
call fcn.00408234
cmp edx, ebx
ja 0x407ee7
cmp eax, ebx
jbe 0x407eec
mov ecx, dword [esi]
mov dword [ecx + 0x2e], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408db8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
push edi
push str.DGVOODOOCOMM
push edi
jmp 0x408ea9
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push edi
push 0x407
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408ea2
push 0x5b
pop ecx
inc edi
mov word [ebp + eax - 0x808], cx
lea eax, [edi + edi]
movzx ecx, word [eax + str._Running_]
test cx, cx
jne 0x408dfb
lea ecx, [ebp - 0x808]
add ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x400
sub eax, edi
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ebx, [edi + eax]
test esi, esi
je 0x408e7b
xor edi, edi
push edi
push edi
push 0x40a
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x408e91
push 0x20
lea ecx, [ebp - 0x808]
mov eax, edi
pop edx
lea ecx, [ecx + ebx*2]
inc eax
mov word [ecx], dx
lea ecx, [ecx + 2]
movzx edx, word [eax*2 + str.__already_attached_]
test dx, dx
jne 0x408e59
add eax, ebx
xor ecx, ecx
mov word [ebp + eax*2 - 0x808], cx
jmp 0x408e91
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x808]
push eax
call fcn.00408a0b
xor edi, edi
cmp eax, 0xffffffff
jne 0x408ea2
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x808]
push edi
push esi
push eax
call fcn.00408b80
push edi
push str.DGVOODOOCOMM
push esi
push 0xfffffffffffffffd
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x408dd5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push str.RT_CUSTOM
push 0x79
push 0
call edi
test eax, eax
je 0x40a2e0
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0
call ebx
test eax, eax
je 0x40a2e0
push eax
call fcn.0041b4bd
add esp, 4
mov esi, eax
push str.RT_CUSTOM
push 0x79
push 0
call edi
mov edi, eax
test edi, edi
je 0x40a2d7
push edi
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x40a2d7
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a2d7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40a2d7
push ebx
push eax
push esi
call fcn.0041bd00
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
ret
push esi
call fcn.0041b4c6
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x40ac84
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push edx
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret
Function at 0x402cd0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x402cee
mov ecx, dword [ebp - 8]
call fcn.00402d70
jmp 0x402d01
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x402d01
mov ecx, dword [ebp - 8]
call fcn.00402e00
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x402d70
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x402d8b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jae 0x402df7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x402dcf
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x402dd6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x402d82
mov esp, ebp
pop ebp
ret
Function at 0x402e00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], 0x26f
mov dword [ebp - 0x2c], 0xe3
mov dword [ebp - 8], 0
jmp 0x402e29
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe3
jae 0x402e95
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x402e6d
mov dword [ebp - 0x14], 0x9908b0df
jmp 0x402e74
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
shr eax, 1
xor eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x402e20
mov dword [ebp - 0xc], 0xe3
jmp 0x402ea7
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x26f
jae 0x402f13
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
and edx, 1
je 0x402eeb
mov dword [ebp - 0x1c], 0x9908b0df
jmp 0x402ef2
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
shr eax, 1
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x402e9e
mov dword [ebp - 0x30], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x402f5c
mov dword [ebp - 0x24], 0x9908b0df
jmp 0x402f63
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0x24]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret

Function at 0x403cc8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403d07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403d07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403d07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403d07
cmp dword [ecx + 0x74], 0xe
jbe 0x403d07
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407c98
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411594
push 0x41158c
push str.FlsAlloc
push 0x1f
call fcn.00407bb4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407ccc
push dword [ebp + 8]
mov ecx, esi
call dword [0x410128]
call esi
jmp 0x407cd2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407d16
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4115a4
push 0x41159c
push str.FlsGetValue
push 0x21
call fcn.00407bb4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407d4d
push dword [ebp + 8]
mov ecx, esi
call dword [0x410128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407d55
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4115ac
push 0x4115a4
push str.FlsSetValue
push 0x22
call fcn.00407bb4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407d8f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x410128]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x409adb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x409b78
push ebx
push esi
call fcn.00409aa4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00409a38
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x409b25
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409b77
push edi
push eax
call fcn.0040a36e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x409b45
call fcn.00408580
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409b76
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00409a38
add esp, 0x20
test eax, eax
jne 0x409b64
push edi
call fcn.00408580
jmp 0x409b6c
push ebx
call fcn.00408580
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40f610
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f63d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f63d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x53dd6567
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x264a05fc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100011a0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [0x1001fa94], 0
jmp fcn.100cc0bd

Function at 0x10001460
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
call fcn.10001560
mov esi, eax
push 4
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10001487
mov ecx, dword [esi]
jmp 0x10001489
xor ecx, ecx
test esi, esi
je 0x10001554
cmp ecx, 0x1a4b9
je 0x100014b5
cmp ecx, 0x1a8a1
je 0x100014b5
cmp ecx, 0x32b59
je 0x100014b5
cmp ecx, 0x32f41
je 0x100014b5
xor al, al
jmp 0x100014b7
mov al, 1
cmp ecx, 0x1a11d
je 0x100014fc
cmp ecx, 0x327bd
je 0x100014fc
test al, al
jne 0x100014fc
cmp ecx, 0x77a10
jae 0x100014fc
jmp 0x100cfc86
mov byte [ebp - 1], 0xff
jmp 0x100d03e1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100016a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
test edi, edi
je 0x100019cd
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push edi
call esi
test eax, eax
jne 0x100019cd
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100019cd
mov ecx, dword [edi + 0x80]
mov edx, dword [edi + 0xa0]
cmp ecx, 6
je 0x100016f0
cmp ecx, 0xa
je 0x100016f0
xor cl, cl
jmp 0x100016f2
mov cl, 1
cmp dword [ebp + 8], 1
jne 0x1000180d
mov edi, dword [0x1001facc]
push 4
push edi
call esi
test eax, eax
jne 0x1000170f
mov ecx, dword [edi]
jmp 0x10001711
xor ecx, ecx
mov ebx, dword [0x1001fac8]
add ebx, ecx
push 4
push ebx
call esi
test eax, eax
jne 0x10001729
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
jmp 0x10001730
mov dword [ebp - 8], 0
mov edi, dword [0x1001facc]
push 4
push edi
call esi
test eax, eax
jne 0x10001743
mov ecx, dword [edi]
jmp 0x10001745
xor ecx, ecx
mov edi, dword [0x1001fac8]
add edi, ecx
push 4
push edi
call esi
test eax, eax
jne 0x1000175d
mov eax, dword [edi]
mov dword [ebp - 4], eax
jmp 0x10001764
mov dword [ebp - 4], 0
jmp 0x100d21b9
test edx, edx
je 0x1000181c
cmp eax, 0x77a10
jbe 0x100019cd
test cl, cl
jne 0x100019cd
mov edi, dword [0x1001facc]
push 4
push edi
call esi
test eax, eax
jne 0x10001837
mov ecx, dword [edi]
jmp 0x10001839
xor ecx, ecx
mov edi, dword [0x1001fac8]
add edi, ecx
push 4
push edi
call esi
test eax, eax
jne 0x10001851
mov eax, dword [edi]
mov dword [ebp - 8], eax
jmp 0x10001858
mov dword [ebp - 8], 0
jmp 0x100d34dd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001ea0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1001e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1001f790]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
jmp fcn.100d58c0

Function at 0x10001f70
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
jmp fcn.100da4c4

Function at 0x100022b0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
mov eax, dword [0x1001e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp fcn.100df3e8

Function at 0x100023f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
mov eax, dword [0x1001e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp fcn.100e1978

Function at 0x10002530
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012bfc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1001e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
jmp fcn.100e58f5
Function at 0x10002760
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov esi, eax
call edi
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, eax
push 0x64
mov dword [ebp - 4], edi
call esi
call ebx
mov dword [0x1001f78c], eax
call ebx
sub eax, edi
cmp eax, 0xbb8
ja 0x1000286b
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
call fcn.10001ea0
push 0
push 0
push 0
push 0
push 2
call dword [sym.imp.USER32.dll_mouse_event]
push 0x2c
call esi
call fcn.10001ea0
push 0
push 0
push 0
push 0
push 4
call dword [sym.imp.USER32.dll_mouse_event]
mov esi, dword [0x1001fac0]
push 4
push esi
call edi
test eax, eax
jne 0x10002806
mov eax, dword [esi]
jmp 0x10002808
xor eax, eax
lea esi, [eax + 0x22c]
push 4
push esi
call edi
test eax, eax
jne 0x1000281b
mov eax, dword [esi]
jmp 0x1000281d
xor eax, eax
lea esi, [eax + 0x138]
push 4
push esi
call edi
test eax, eax
jne 0x10002830
mov esi, dword [esi]
jmp 0x10002832
xor esi, esi
push 4
push esi
call edi
test eax, eax
jne 0x1000284a
cmp dword [esi], eax
je 0x1000284a
xor ecx, ecx
call fcn.10001d00
test eax, eax
jne 0x1000286b
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
call ebx
mov dword [0x1001f78c], eax
call ebx
sub eax, dword [ebp - 4]
cmp eax, 0xbb8
jbe 0x100027c5
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [0x1001f78c], eax
call ebx
push 1
mov esi, eax
call ebx
mov edi, dword [sym.imp.USER32.dll_SetCursorPos]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
call edi
call fcn.10001f70
push 0
call ebx
push 1
mov esi, eax
call ebx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
call edi
call fcn.10001f70
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
call fcn.10001f70
push 0x32
call esi
push 0
call ebx
push 1
mov esi, eax
call ebx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
call edi
pop edi
pop esi
mov dword [0x1001fae4], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002bb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp fcn.100e5f9b
Function at 0x10003be0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10003bfe
push 0
push 0
push 0
push 0x100039b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x10008bd9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10008c18
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10008c18
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10008c18
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10008c18
cmp dword [ecx + 0x74], 0xe
jbe 0x10008c18
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000a2a4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015794
push 0x1001578c
push str.FlsAlloc
push 0x1f
call fcn.1000a180
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a2d8
push dword [ebp + 8]
mov ecx, esi
call dword [0x10013150]
call esi
jmp 0x1000a2de
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000a322
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100157a4
push 0x1001579c
push str.FlsGetValue
push 0x21
call fcn.1000a180
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a359
push dword [ebp + 8]
mov ecx, esi
call dword [0x10013150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000a361
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100157ac
push 0x100157a4
push str.FlsSetValue
push 0x22
call fcn.1000a180
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a39b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10013150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000c478
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000c515
push ebx
push esi
call fcn.1000c441
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000c3d5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000c4c2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000c514
push edi
push eax
call fcn.1000aee4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000c4e2
call fcn.1000a58c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000c513
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000c3d5
add esp, 0x20
test eax, eax
jne 0x1000c501
push edi
call fcn.1000a58c
jmp 0x1000c509
push ebx
call fcn.1000a58c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret