joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c6d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0xc8
push 0xffffffffffffffff
push 0x1001bfcb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100341b0]
xor eax, ebp
mov dword [ebp + 0xc4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [0x100373c8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push 0x40
push eax
call fcn.1000ec85
add esp, 0x14
lea edx, [ebp]
push edx
push 1
xor ecx, ecx
push esi
mov word [ebp + 0x80], cx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x1000c8bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000c76e
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e
lea ecx, [ebp + 0x86]
xor eax, eax
push esi
mov dword [ebp - 4], esi
push ecx
mov word [ebp + 0x84], ax
call fcn.1000e5a0
add esp, 0xc
push 0x1f
lea edx, [ebp + 0x84]
push edx
call fcn.1000c3c0
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x1000c7d5
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov word [ebp + eax*2 + 0x84], cx
lea eax, [ebp + 0x84]
push 0x10030d78
push eax
call fcn.1000e8f7
add esp, 0xc
cmp eax, 1
jne 0x1000c7d5
mov eax, dword [ebp - 0x14]
mov dword [0x100373c8], eax
jmp 0x1000c8a5
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x1000c7ef
push 0x5c0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x1000c803
push ebx
push esi
call fcn.1000cb20
jmp 0x1000c805
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x100373c8], eax
test eax, eax
jne 0x1000c827
push 0x10031b78
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 1
call fcn.1000e06b
push eax
lea edx, [ebp + 0x84]
push 0x10030d78
push edx
mov edi, 1
call fcn.1000ed58
add esp, 0xc
lea esi, [ebp + 0x84]
call fcn.1000c500
test eax, eax
jne 0x1000c89e
push 0x10031b78
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 3
call fcn.1000e06b
call fcn.1000c5a0
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x100373c8]
test esi, esi
je 0x1000c88f
call fcn.1000cc00
mov dword [0x100373c8], 0
jmp 0x1000c896
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1000c89c
ret
mov eax, dword [0x100373c8]
xor esi, esi
inc dword [eax + 0x5bc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp edi, esi
jne 0x1000c8bd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x100373c8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc4]
xor ecx, ebp
call fcn.1000d16f
add ebp, 0xc8
mov esp, ebp
pop ebp
ret
Function at 0x1000c8f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001bf40
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100341b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x100373c8]
xor edi, edi
cmp ecx, edi
jne 0x1000c93b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x1000c948
mov dword [ebp - 0x14], edi
jmp 0x1000c960
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x1000c9f6
mov ecx, dword [0x100373c8]
mov eax, dword [ecx]
cmp eax, edi
je 0x1000c927
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000c927
mov ebx, 0x100373c8
mov dword [ebp - 4], edi
call fcn.1000ca10
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x1000c99e
push 0x10031b78
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.1000e06b
mov ecx, dword [0x100373c8]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x1000c9b8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x1000c9e2
push 0x10031b78
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.1000e06b
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1000c9d9
call fcn.1000cd20
mov eax, 0x1000c9df
ret
mov eax, dword [0x100373c8]
mov eax, dword [eax]
test eax, eax
je 0x1000c9f4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ca10
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x1000ca3d
xor ecx, ecx
jmp 0x1000ca49
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x1000cafd
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x1000ca70
mov dword [esp + 0xc], esi
jmp 0x1000cad0
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x1000cac9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1000cabc
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x1000cad0
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000cad0
push 0x10030d80
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000cad0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x1000caf3
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x1000ca62
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x1000cb11
mov ecx, dword [ebx]
add ecx, 8
call fcn.1000cc50
test eax, eax
je 0x1000cb11
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x1000cb20
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x1001bf9b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100341b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.1000e5a0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x1000cbb8
push 0x10031b78
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.1000e06b
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x1000d16f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100341b0]
jne 0x1000d179
repz ret
jmp fcn.1000f4dd
Function at 0x1001865d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000f78a
and dword [ebp - 4], 0
cmp dword [0x10036280], 0
mov ebx, eax
jne 0x1001870e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100187bf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100187bf
push eax
call fcn.1000f718
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10036280], eax
call esi
push eax
call fcn.1000f718
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10036284], eax
call esi
push eax
call fcn.1000f718
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10036288], eax
call esi
push eax
call fcn.1000f718
pop ecx
mov dword [0x10036290], eax
test eax, eax
je 0x1001870e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000f718
pop ecx
mov dword [0x1003628c], eax
mov eax, dword [0x1003628c]
cmp eax, ebx
je 0x10018766
cmp dword [0x10036290], ebx
je 0x10018766
push eax
call fcn.1000f793
push dword [0x10036290]
mov esi, eax
call fcn.1000f793
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10018766
test edi, edi
je 0x10018766
call esi
test eax, eax
je 0x1001875d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001875d
test byte [ebp - 0xc], 1
jne 0x10018766
or dword [ebp + 0x10], 0x200000
jmp 0x1001879f
mov eax, dword [0x10036284]
cmp eax, ebx
je 0x1001879f
push eax
call fcn.1000f793
pop ecx
test eax, eax
je 0x1001879f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001879f
mov eax, dword [0x10036288]
cmp eax, ebx
je 0x1001879f
push eax
call fcn.1000f793
pop ecx
test eax, eax
je 0x1001879f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10036280]
call fcn.1000f793
pop ecx
test eax, eax
je 0x100187bf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100187c1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404f00
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4442f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x514
push ebx
push ebp
push esi
push edi
mov ebp, ecx
or esi, 0xffffffff
mov dword [esp + 0x14], ebp
mov dword [ebp + 4], esi
xor ebx, ebx
mov dword [ebp], 0x447520
mov dword [esp + 0x52c], ebx
mov dword [ebp + 0x20], esi
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
lea ecx, [ebp + 0x28]
mov byte [esp + 0x544], 1
call fcn.0043f078
mov dword [ebp + 0x60], esi
push ebx
push ebx
push 1
push ebx
mov byte [ebp + 0x40], bl
mov byte [ebp + 0x41], bl
mov byte [ebp + 0x25], bl
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0x866], bl
mov dword [ebp + 0xc], ebx
mov byte [ebp + 0x864], bl
mov byte [ebp + 0x865], bl
mov byte [ebp + 0x24], bl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp + 0x20], eax
push str..CONFIG.ini
mov byte [ebp + 0x874], bl
mov ecx, 7
mov esi, str.www.shaiyadestiny.com_
mov edi, 0x45b9c0
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0x447078
push str.TEST_IP
push str.LOGIN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4050db
mov edi, str.GERMANY
lea esi, [esp + 0x18]
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x405035
mov edi, str.FRANCE
lea esi, [esp + 0x18]
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x405035
mov edi, str.POLAND
lea esi, [esp + 0x18]
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4050db
push 0x44741c
push str.UpdaterURL.txt
call fcn.00420efc
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x405065
push ebx
push str.Error
push str.Cant_Find_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00420ceb
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x120]
push eax
push 0x4470bc
push esi
call fcn.00420f0f
lea eax, [esp + 0x12c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405095
sub eax, edx
cmp eax, 1
jae 0x4050bb
push ebx
push str.Error
push str.Cant_Read_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00420ceb
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x120]
mov byte [eax + 0x45b9c0], cl
inc eax
cmp cl, bl
jne 0x4050c0
push esi
call fcn.00420e4f
add esp, 4
mov ecx, dword [esp + 0x524]
pop edi
mov eax, ebp
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101019e4
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + edx*8 - 0x71635598], ebp
call fcn.103ac704
pop edi
in al, 0x4f
push ds
jb 0x10101a6a
imul ecx, edx, 0x78aae9cd
xor eax, 0x45f5c430
mov ebp, 0x33bc3d68
pushfd
add dword [ecx], edi
sbb cl, byte [edi + 0x50]
insb byte es:[edi], dx
jo 0x10101a6e
adc ch, bh
retf
invalid
call 0x8f40de71
push ss
xor byte [edi + 0x16], bh
jg 0x10101aaa
mov ch, 0x2f
call 0x95d0ef1c
aam 0x7a
lcall 0x349d, 0x5305f83c
jne 0x10101a71
dec eax
adc dword [ebp + 0x48], eax
ret
xchg edi, eax
lodsd eax, dword [esi]
sbb al, 0xa1
invalid
cmpsb byte [esi], byte es:[edi]
and eax, 0x94d0c06a
sbb al, 0xbe
test eax, 0x318d26fa
dec ebx
inc edi
sbb cl, dh
sub dword ss:[0xb1a79294], esi
xor esi, ecx
jno 0x10101aca
invalid
movsb byte es:[edi], byte [esi]
jecxz 0x10101a95
pop ds
pushal
mov cl, byte [ebx + 0x75]
add al, 0xe5
pushal
or al, 0xfe
and al, 0xcd
xor al, 0x25
wait
adc eax, 0xdd7676e2
wait
jne 0x10101ac4
retf

Function at 0x1015c0ef
Capabilities:
Check http status code

Disassembly:
xor ebx, esi
push esi
mov esi, dword [esp + 0x14]
or dword [esp], 0x5dc93c40
cmovbe bx, word [esp + 0x32]
not word [esp]
call fcn.101c6ac7
dec ecx
ror ecx, 2
jmp 0x1026080e
js 0x1009c95c
test ebp, 0x60d23cbe
shr ax, cl
setb cl
cmovp cx, sp
xchg ecx, ecx
mov word [edi + 4], ax
not ecx
xchg ch, ch
bswap cx
pushfd
sal ecx, cl
rol cl, cl
pop dword [edi]
mov ch, dl
ror ecx, cl
sub esi, 4
btc cx, 0x13
neg ch
mov ecx, dword [esi]
xor ecx, ebx
clc
ror ecx, 3
jmp 0x1010e881
inc ecx
cmp al, 0xc8
test ah, 0xcd
neg ecx
bswap ecx
stc
lea ecx, [ecx - 0x4b7d3e27]
xor ebx, ecx
add ebp, ecx
jmp fcn.10337126
Function at 0x10170150
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x16
ja 0x1017014f
cmpsb byte [esi], byte es:[edi]
invalid
cmpsb byte [esi], byte es:[edi]
mov eax, esi
add dword [esp + 0xc], esi
and dl, 0x27
push esi
mov eax, dword [esp + 8]
mov eax, dword [eax + esi - 0xb1810f5]
or edx, dword [esp + 0x14]
pop edi
cmova dx, si
sub edi, dword [esp + 0xc]
lea eax, [eax + 0x5c4020c8]
mov dword [esp + 4], edi
push ebx
xchg dword [esp + esi*4 - 0x2c6043b0], eax
cmp esi, 0x74511127
not dword [esp + 0x10]
mov ebx, 0x45523991
call fcn.10388f6a
fbstp tbyte [edx]
jae 0x1017021a
xor dh, byte [ebx + 0x7e]
jbe 0x1017013c
stosd dword es:[edi], eax
mov esi, dword [ecx]
jg 0x10170199
cdq
stc
pause
pop ecx
xor dword [ecx], edi
push ebp
nop
jo 0x101701f2
or ch, byte [ecx + 0x1e814999]
fild qword [edx]
or bl, byte [edx - 0x62]
dec edx
rcr bl, cl
dec ecx
and ebp, dword [ebp + edi*2 - 0x3b]
in eax, dx
pop edx
int3
push ebp
test al, 0xcb
xchg ebx, eax
xor dl, 0x6c
mov ah, 0x53
rcl dh, cl
push edi
and al, 0x4d
sub esp, esi
jle 0x1017024e
invalid
sub al, 4
test byte [ecx - 0x17b0b1ae], dl
pop ss
insb byte es:[edi], dx
jle 0x10170223
loopne 0x10170279
mov ch, 0xe1
sub al, byte [ecx + 0xd]
push 0x2d
add byte [eax], al
add byte [edi - 2], dh
dec edi
sub byte [ecx + 0x44369292], bl
dec byte [edi + 0x28]
cdq
xchg edx, eax
xchg edx, eax
inc esp
stc
and dword [edi + 0x3e], 0x41
jns 0x10170252
invalid
stosb byte es:[edi], al
out dx, al
scasb al, byte es:[edi]
pop edi
out 0xca, eax
or al, 0x15
xlatb
sub esp, dword [esp + ebp*4 + 0x1788610]
add ebx, dword [ebp - 0x2e]
or al, cl
clc
popal
mov ebx, 0xfee31006
push ebp
dec ebp
int 0x31
dec edi
cli
mov ebp, dword [esi + eax*8]
lds ebp, [edi]
mov esp, 0xe5d4c878
jp 0x1017023b
adc bl, ah
invalid
adc edx, edx
jb 0x10170254
arpl bp, bx
fidivr word [ebx - 0x54]
test bl, bh
mov ah, byte [ebp + 0x56d027ba]
add dword [edx + esi*2 - 0x41], 0xffffff96
rcl byte [esi - 0x7d]
inc esp
jb 0x1017023e
xchg esi, eax
jp 0x1017020a
mov al, 0xff
salc
dec edx
sahf
lock btc dword [ebx + ebx*4], 0x13
or al, byte [eax]
mov dword [0xbd217b41], eax
adc ecx, dword [edx]
add byte [ebx - 0x42de84bf], ah
fist word [esi + 0x41]
dec esi
sub byte [esi + ecx*8 + 0x2ae878b5], ah
jno 0x1017028c
fiadd dword [edi - 0x6b7adb82]
mov eax, 0x78e16619
fcmovnu st(0), st(5)
cmp eax, 0x511afd77
fadd qword es:[eax + ebx*4 - 0x2f57ba72]
sbb dword [esi - 0x12], eax
dec esi
invalid

Function at 0x1033dd2c
Capabilities:
Check for software breakpoints

Disassembly:
je 0x1040e69d
dec eax
lea ebx, [0x2c6559]
lea ebx, [esi + 0x51ee1ddd]
mov esi, dword [esp + 0x1c]
call fcn.10197f3f
stc
inc ebp
xor esi, esi
inc ecx
cmp dl, 1
stc
dec eax
test ecx, ecx
jmp 0x1012c63a
Function at 0x1037da25
Capabilities:
Encode data using xor

Disassembly:
neg ecx
cmp bx, 0x7878
cmp esi, esi
bswap ecx
test bl, bl
xor ebx, ecx
cmc
stc
clc
add edi, ecx
jmp 0x10376e81
push cs
mov al, byte [esi + 4]
jmp 0x102400c9
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x28]
call fcn.10164d67
and al, 0xe5
jno 0x1015bad6
les ecx, [ebp - 0x49]
and al, 0x68
out 0x76, al
je 0x1015ba6a
xor dword [esi - 0xa], eax
inc esi
sti
xor dword [ecx + 0x50553bee], ecx
xor dword [ecx + 0x50553bee], ecx
test al, 0x9b
or byte [ecx + 0x1c5ed1c1], ch
fbstp tbyte [edx + 0x4a9c8592]
sub dh, byte [ebx - 0x6a]
and dword [esp - 0x2b], ebp
xor bl, byte [eax - 0x34]
push 0xffffffffffffff9a
push 0xdcd4d34b
jecxz 0x1015baed
test byte [edx], cl
rcl dword [esi - 0x34], cl
xchg edi, eax
fnstcw word [eax]
xchg ebp, eax
popal
into
sbb byte [eax + 0x170c13a7], dh
dec dword [edi]
shr dword [edx - 0x1f85490a], cl
push esi
out dx, eax
xlatb
mov edi, 0xcc0420f4
je 0x1015bae7
xchg esp, eax
pop esp
sbb ebx, esp
mov bh, ah
test al, 0xb9
mov dword [0x13250106], eax
push esp
cmp dword [0x15000000], ebp
or dword [esi], 0x8912a87
sub al, 0x5f
cmp byte [ecx], 0xc
retf 0x8e1f
add esi, 6
mov byte [ecx], al
test esp, 0xb1e1808
mov ecx, dword [ebp]
cmp ebp, 0xf763d17
cmp ah, bl
cmc
lea ebp, [ebp + 4]
cmp ch, 0x1a
xor ecx, ebx
clc
ror ecx, 1
bswap ecx
clc
jmp 0x100b79f5
jmp edi
jae 0x1015bac6
call fcn.102ad082
mov ax, word [ebp]
xor dh, 0xd5
mov dx, word [ebp + 2]
lea ebp, [ebp - 2]
test dl, 0x86
cmp ecx, 0x70757ccf
add ax, dx
jmp 0x103c8f0f
jmp fcn.10094135
mov word [ebp + 4], ax
not al
pushfd
sar eax, cl
cmc
pop dword [ebp]
shr al, cl
neg al
lea esi, [esi - 4]
test sp, 0x75fd
nop
btc eax, esi
mov eax, dword [esi]
xor eax, ebx
test eax, edi
sub eax, 0x269a50e9
clc
cmc
stc
not eax
ror eax, 2
cmp dh, 0x14
xor eax, 0x2055236a
stc
cmc
rol eax, 1
xor ebx, eax
cmp esi, 0x2cda7197
test ebp, edx
add edi, eax
jmp 0x103be6b2

Function at 0x10392a3d
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.103198a0
inc ecx
ror ecx, 3
neg ecx
not ecx
cmc
ror ecx, 3
xor ebx, ecx
clc
stc
add ebp, ecx
jmp 0x1020147e
add edi, 4
clc
cmc
cmp dx, 0x5450
xor ecx, ebx
jmp 0x10228136
add dword [esp + 4], 0x4cf8c
add dword [esp + 0xc], 0xa094d
call fcn.102f46bb
loopne 0x10392a92
test dword [ebp - 0x355a85d0], esi
sub dword [esi], edi
mov ch, byte [edi - 0x3c]
push ebp
adc edi, esp
cld
je 0x10392a61
test eax, 0x474a8db
stosb byte es:[edi], al
sub byte [ebx + ebx*4 + 0x13], dl
salc
ljmp 0x8891
xchg esp, eax
adc ecx, dword [0x2d82942a]
push esi
push esp
sbb eax, 0xf31ec6e4
inc ebx
inc ebx
jnp 0x10392a1c
inc edx
push ds
mov dl, 0xad
cmpsd dword [esi], dword es:[edi]
mov al, 0x27
xor dword es:[ebp + 0x22], esp
in eax, dx
sub al, 0x46
in eax, dx
add byte [ecx - 0x4d], ah
xor al, 0x35
salc
imul ecx, dword [esi - 0x5af4efce], 0x46
stosb byte es:[edi], al
dec eax
cmp al, 0xa5
lahf
push esp
jnp 0x10392a84
outsb dx, byte [esi]
jb 0x10392ace
add dh, byte [ebx + 0x2de02f0a]
push esi
xchg esp, eax
int3
push edi
std
push 0xffffffffffffffc2
leave
imul ecx, dword [edi - 0x6261fa3b], 0xcda47d4c
or byte [edx], al
dec esi
dec edi
in eax, dx
cmp dl, byte [edx]
and dl, byte [edi + edi*8]
iretd
Function at 0x103b30c8
Capabilities:
Encode data using xor

Disassembly:
add dl, byte [esp + 0x17]
call fcn.1019e7fd
jmp fcn.10337126
call fcn.103b019f
xor bh, byte [ecx + 0x620d966f]
push edi
jno 0x103b308c
outsb dx, byte [esi]
pop ecx
movsb byte es:[edi], byte [esi]
mov dl, 0x29
add esp, eax
test byte [edx + 0x3945be49], 0x8c
imul ecx, esp, 0x56743e3c
sub esp, dword [esi - 0x28]
mov dword [ecx + 0x6d], ecx
and al, 0xcb
jne 0x103b316a
inc ebp
sub eax, 0xe2813d13
jae 0x103b316c
fistp qword [ebp + ecx*4 + 0xe7f11a0]
inc ebp
inc edi
cld
xor ch, byte [edi + eax*8 + 0xc]
out dx, eax
outsd dx, dword [esi]
adc eax, 0x9ced7ee2
jno 0x103b3106
test dword [ebx + 0x7f], esp
cmp eax, dword [ecx + 0x68a42e5e]
xchg esp, eax
cli
cli
mov ah, dh
popfd
lds edi, [esi - 0x10]
invalid
and edi, edi
mov eax, dword [0xff844dde]
ror byte [ebp + 0x13eb4900], 1
loope 0x103b31ab
mov esi, 0x37d4b4fc
ret 0x5916
jmp 0xf6767344

Function at 0x104042e9
Capabilities:
Check for software breakpoints

Disassembly:
add dword [esp + 8], 0x60043efc
add dword [esp + 4], 0x3e0067
mov edx, 0xca56f60
cmp word [esp + 8], dx
mov edi, edx
movsx edx, byte [esp + 8]
mov dword [esp + 0xc], edx
mov edi, dword [esp + 4]
mov edi, dword [edi + edx - 0x5d]
call fcn.1012483e
inc ecx
inc ebx
inc ecx
ror ebx, 3
cmc
inc ebp
cmp ebp, edx
inc ecx
xor ebx, 0x1f3b16c3
inc ecx
push edi
inc cx
rcl edi, 0x93
inc ecx
setp bh
inc bp
shld edi, edx, 0xd4
inc esp
xor dword [esp], ebx
inc cx
and edi, 0x224556f7
inc dword [ecx + 0x5f]
clc
inc cx
cmp edi, 0x8441439e
retf 0x634d
mov dword [esp + 8], 0x8511ba6
push edx
jns 0x1009f1df
inc ecx
not ebx
jmp 0x1022e2c3
Function at 0x4012a0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401333
push 0
push str.TrayNotifyWnd
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401333
push 0
push str.SysPager
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40131d
push 0
push 0x4e9078
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
jmp 0x401333
push 0
push str.ToolbarWindow32
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret