joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100319e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101b2c70]
push esi
mov esi, dword [0x101b2c74]
push edi
movsd xmm0, qword [eax]
lea eax, [ebp - 4]
subsd xmm0, qword [0x101a2fa0]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
andps xmm0, xmmword [0x101a3d40]
mulsd xmm0, qword [0x101a2c20]
push esi
addsd xmm0, qword [0x101a32a8]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x101b2c70]
mov esi, dword [0x101b2c78]
movsd xmm0, qword [eax]
lea eax, [ebp - 4]
subsd xmm0, qword [0x101a2fa0]
push eax
push 0x40
push 8
push esi
andps xmm0, xmmword [0x101a3d40]
mulsd xmm0, qword [0x101a2c20]
addsd xmm0, qword [0x101a32a8]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x101b2c70]
mov esi, dword [0x101b2c7c]
movsd xmm0, qword [eax]
lea eax, [ebp - 4]
subsd xmm0, qword [0x101a2fa0]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x101a3d40]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x101a2da8]
addss xmm0, dword [0x101a38cc]
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
mov eax, dword [0x101b2c70]
mov esi, dword [0x101b2c80]
movsd xmm0, qword [eax]
lea eax, [ebp - 4]
subsd xmm0, qword [0x101a2fa0]
push eax
andps xmm0, xmmword [0x101a3d40]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x101a2da8]
addss xmm0, dword [0x101a38cc]
movss dword [ebp - 0xc], xmm0
push 0x40
push 4
push esi
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
mov eax, dword [0x101b2c70]
mov esi, dword [0x101b2c84]
movsd xmm0, qword [eax]
lea eax, [ebp - 4]
subsd xmm0, qword [0x101a2fa0]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x101a3d40]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x101a2da8]
addss xmm0, dword [0x101a38c0]
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10031bc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x58], 0
je 0x10031d79
movss xmm0, dword [ebx + 0x5c]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x60]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0x10]
push eax
push 0x40
push 4
push esi
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x64]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0x14]
push eax
push 0x40
push 4
push esi
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
movsd xmm0, qword [ebx + 0x68]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0x18]
push eax
push 0x40
push 8
push esi
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movsd qword [esi], xmm0
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x70]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0x1c]
push eax
push 0x40
push 8
push esi
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 4]
movsd qword [esi], xmm0
push eax
push dword [ebp - 4]
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x78]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0x20]
push eax
push 0x40
push 8
push esi
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movsd qword [esi], xmm0
push 8
push esi
call edi
movss xmm0, dword [ebx + 0x80]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0x24]
push eax
push 0x40
push 4
push esi
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x84]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0x28]
push eax
push 0x40
push 4
push esi
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x88]
lea eax, [ebp - 4]
mov esi, dword [ebx + 0x2c]
push eax
push 0x40
push 4
push esi
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [esi], xmm0
push 4
push esi
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100332c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x57655b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x57655b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x57655b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10033300
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov byte [ebp - 0x10], 0xe8
push eax
push 0x40
push 5
push 0x57655b
mov dword [ebp - 0xf], 0x93250
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003335a
mov eax, dword [ebp - 0x10]
mov ecx, 0x57655b
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10033360
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x10033370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x5de2b2
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100333ba
lea eax, [ebp - 8]
mov byte [0x5de2b2], 1
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x5de2b2
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100333c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x100333d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x5de2b2
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003341a
lea eax, [ebp - 8]
mov byte [0x5de2b2], 0
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x5de2b2
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10033420
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x10033630
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x576ddb
call esi
mov eax, 0x576ddb
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x576ddb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5883f4
call esi
mov eax, 0x5883f4
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x5883f4
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100336a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x576ddb
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], 0xfffee7e0
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x100336f9
mov eax, dword [ebp - 0x10]
mov ecx, 0x576ddb
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100336ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
mov byte [ebp - 0x10], 0xe8
push eax
push 0x40
push 5
push 0x5883f4
mov dword [ebp - 0xf], 0xfffdd1c7
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x1003374b
mov eax, dword [ebp - 0x10]
mov ecx, 0x5883f4
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10033751
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10033760
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x588661
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x588661
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x588661
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x100337a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov byte [ebp - 0x10], 0xe8
push eax
push 0x40
push 5
push 0x588661
mov dword [ebp - 0xf], 0xfffdcf5a
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100337fa
mov eax, dword [ebp - 0x10]
mov ecx, 0x588661
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10033800
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x10033870
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x54a270
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [0x54a270], 0xc3
push eax
push dword [ebp - 4]
push 1
push 0x54a270
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x100338b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x54a270
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [0x54a270], 0x55
push eax
push dword [ebp - 4]
push 1
push 0x54a270
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x100338f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x59af55
call esi
lea eax, [ebp - 4]
mov byte [0x59af55], 0
push eax
push dword [ebp - 4]
push 1
push 0x59af55
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x59b24a
call esi
lea eax, [ebp - 4]
mov byte [0x59b24a], 0
push eax
push dword [ebp - 4]
push 1
push 0x59b24a
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10033950
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x59af55
call esi
lea eax, [ebp - 4]
mov byte [0x59af55], 1
push eax
push dword [ebp - 4]
push 1
push 0x59af55
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x59b24a
call esi
lea eax, [ebp - 4]
mov byte [0x59b24a], 1
push eax
push dword [ebp - 4]
push 1
push 0x59b24a
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10034f90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], 0
lea edi, [edx - 0xf]
push 1
mov esi, ecx
movd xmm1, edi
push 1
sub esp, 0x20
mov ebx, 0x637c60
cvtdq2ps xmm1, xmm1
lea eax, [esi - 8]
mov dword [esp + 0x1c], 0x3e2bedf6
mov dword [esp + 0x18], 0x3f400000
mov dword [esp + 0x14], 0
movd xmm0, eax
mov dword [esp + 0x10], 0
cvtdq2ps xmm0, xmm0
mov dword [esp + 0xc], 0x41700000
mov dword [esp + 8], 0x42ac0000
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
push 0xf069
call ebx
add esp, 0x30
add esi, 0x42
cmp dword [0x1032a298], 0
mov eax, 0x790b10
push 0xb
push 0xb
push edi
push esi
jne 0x10035119
call eax
add esp, 0x10
test al, al
je 0x100350e5
push 1
mov eax, 0x791070
call eax
add esp, 4
test eax, eax
je 0x100350e5
cmp byte [0x8793386], 0
je 0x100350e5
mov eax, 0x83c080
call eax
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x1c], 0x3dc84620
mov dword [esp + 0x18], 0x3ddf6fce
mov dword [esp + 0x14], 0x3ed38c54
mov dword [esp + 0x10], 0x3f19999a
mov dword [esp + 0xc], 0x41300000
mov dword [esp + 8], 0x41300000
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push 0xf069
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x30
call esi
mov ecx, dword [0x1032a29c]
add ecx, 0xc8
cmp eax, ecx
jb 0x1003523f
mov dword [0x1032a298], 1
call esi
pop edi
pop esi
mov dword [0x1032a29c], eax
pop ebx
ret
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
mov dword [esp + 0x1c], 0x3dc84620
mov dword [esp + 0x18], 0x3ddf6fce
mov dword [esp + 0x14], 0x3ed38c54
mov dword [esp + 0x10], 0x3ef74bc6
jmp 0x1003520c
call eax
add esp, 0x10
test al, al
je 0x100351dd
push 1
mov eax, 0x791070
call eax
add esp, 4
test eax, eax
je 0x100351dd
cmp byte [0x8793386], 0
je 0x100351dd
mov eax, 0x83c080
call eax
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x1c], 0x3dc84620
mov dword [esp + 0x18], 0x3ddf6fce
mov dword [esp + 0x14], 0x3ed38c54
mov dword [esp + 0x10], 0x3e041892
mov dword [esp + 0xc], 0x41300000
mov dword [esp + 8], 0x41300000
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push 0xf069
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x30
call esi
mov ecx, dword [0x1032a29c]
add ecx, 0xc8
cmp eax, ecx
jb 0x1003523f
mov dword [0x1032a298], 0
call esi
pop edi
pop esi
mov dword [0x1032a29c], eax
pop ebx
ret
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
mov dword [esp + 0x1c], 0x3dc84620
mov dword [esp + 0x18], 0x3ddf6fce
mov dword [esp + 0x14], 0x3ed38c54
mov dword [esp + 0x10], 0x3c54fdf3
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0xc], 0x41300000
mov dword [esp + 8], 0x41300000
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push 0xf069
call ebx
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x100385b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186215
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x74
mov eax, dword [0x101b11c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1019b318]
xorps xmm0, xmm0
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x58], 0xc
movq xmm0, qword [str.ContinenteMu]
mov dword [ebp - 0x54], 0xf
movq qword [ebp - 0x68], xmm0
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
mov ecx, 0x10369130
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038630
sub ecx, edx
mov edx, 0xc
push ecx
push 0x10369130
lea ecx, [ebp - 0x68]
call fcn.100387e0
add esp, 8
test al, al
je 0x1003868b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x84]
push eax
push 0x40
push 4
push 0xd27b1c
call esi
lea eax, [ebp - 0x84]
mov dword [0xd27b1c], 0x447a0000
push eax
push dword [ebp - 0x84]
push 4
push 0xd27b1c
call esi
cmp dword [0x10369150], 0
jle 0x10038699
call fcn.1001e4d0
call fcn.100a4060
cmp byte [0x10369160], 1
jne 0x100386b1
mov ecx, 0x105b2a50
call fcn.100ac450
mov eax, dword [0x1019b320]
xorps xmm0, xmm0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x80], eax
mov ax, word [0x1019b324]
mov dword [ebp - 0x70], 6
mov dword [ebp - 0x6c], 0xf
mov word [ebp - 0x7c], ax
mov byte [ebp - 0x7a], 0
mov ecx, 0x10369130
mov byte [ebp - 4], 1
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100386e8
sub ecx, edx
mov edx, 6
push ecx
push 0x10369130
lea ecx, [ebp - 0x80]
call fcn.100387e0
add esp, 8
test al, al
je 0x100387c1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0xe8c578]
jne 0x100387c1
push 0x7a
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x100387c1
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
mov ecx, dword [0x10369168]
add ecx, 0x1f4
test edx, edx
jb 0x100387c1
ja 0x10038750
cmp eax, ecx
jb 0x100387c1
cmp dword [0x1032a2f8], 1
lea eax, [ebp - 0x50]
je 0x1003878b
push 0x1019b328
push 0x3c
push eax
call sym.Main.dll_sprintf_s
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0
push 0x101f9630
call fcn.1007b660
add esp, 0xc
call fcn.100338f0
mov eax, 1
jmp 0x100387b5
push 0x1019b340
push 0x3c
push eax
call sym.Main.dll_sprintf_s
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0
push 0x101f9630
call fcn.1007b660
add esp, 0xc
call fcn.10033950
xor eax, eax
mov dword [0x1032a2f8], eax
call esi
mov dword [0x10369168], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10141944
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1003fba0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x4034]
test eax, eax
je 0x1003fbcc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x4034]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4034], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1003fbe2
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x1003fbf7
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
mov byte [esi + 0x4038], 0
pop esi
ret

Function at 0x1003fc00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.10143130
mov eax, dword [0x101b11c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x101b6f5c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x101b2f44], 0xffffffff
je 0x1003fd2e
cmp byte [0x101b6f78], 0
je 0x1003fd2e
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2004]
push esi
push edi
push eax
call fcn.10143ac0
mov ecx, dword [0x101b6f50]
add esp, 0xc
test ecx, ecx
jle 0x1003fc77
lea eax, [ecx + esi]
cmp eax, 0x2000
jg 0x1003fd05
push esi
lea eax, [ebp - 0x2004]
push eax
jmp 0x1003fcd1
xor edi, edi
test esi, esi
jle 0x1003fce6
nop dword [eax]
push 0
lea eax, [ebp - 0x2004]
add eax, edi
push esi
push eax
push dword [0x101b2f44]
mov dword [ebp - 0x2008], eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1003fcad
sub esi, eax
add edi, eax
test esi, esi
jg 0x1003fc80
jmp 0x1003fce6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1003fd05
mov ecx, dword [0x101b6f50]
lea eax, [ecx + esi]
cmp eax, 0x2000
jg 0x1003fd05
push esi
push dword [ebp - 0x2008]
lea eax, [ecx + 0x101b4f50]
push eax
call fcn.10143ac0
add esp, 0xc
add dword [0x101b6f50], esi
push 0x101b6f5c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10141944
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x101b2f40
call fcn.1003fba0
push 0x101b6f5c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10141944
mov esp, ebp
pop ebp
ret 8
push 0x101b6f5c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.10141944
mov esp, ebp
pop ebp
ret 8
Function at 0x100464a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f9e68]
cmp eax, 0x5dc
jb 0x1004653f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x101f9e6d], 1
mov dword [0x101f9e68], eax
jne 0x100464da
mov byte [0x101f9e6d], 0
mov esp, ebp
pop ebp
ret
mov eax, 0x1036bc14
nop
mov dword [eax], 0xffffffff
add eax, 8
cmp eax, 0x1036bd64
jl 0x100464e0
mov edx, 4
mov dword [0x1036b4d4], 0
lea ecx, [ebp - 4]
mov dword [0x1036b4cc], 0
mov dword [ebp - 4], 0xe8f304c1
call fcn.100ca8d0
cmp dword [0x101ebd94], 2
jne 0x1004652e
mov eax, dword [0x1058eed0]
mov byte [eax + 0x29], 1
mov esp, ebp
pop ebp
ret
mov byte [0x101f9e6d], 1
mov dword [0x101ebaa0], 1
mov esp, ebp
pop ebp
ret

Function at 0x100482f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f9e68]
cmp eax, 0x5dc
jb 0x1004839d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x101f9e6d], 1
mov dword [0x101f9e68], eax
jne 0x1004832c
mov byte [0x101f9e6d], 0
mov esp, ebp
pop ebp
ret
mov ecx, 0x1036bd70
call fcn.10047c70
mov edx, 4
mov dword [0x1036bd78], 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xe7f304c1
call fcn.100ca8d0
mov edx, 5
mov dword [ebp - 8], 0xe6f305c1
lea ecx, [ebp - 8]
mov dword [0x1036bd70], 0
mov byte [ebp - 4], 0
call fcn.100ca8d0
cmp dword [0x101ebd94], 2
jne 0x1004838c
mov eax, dword [0x1058eedc]
mov byte [eax + 0x29], 1
mov esp, ebp
pop ebp
ret
mov byte [0x101f9e6d], 1
mov dword [0x101ebaa0], 3
mov esp, ebp
pop ebp
ret