joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ab40
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x4034]
test eax, eax
je 0x1003ab6c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x4034]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4034], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1003ab82
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x1003ab97
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
mov byte [esi + 0x4038], 0
pop esi
ret

Function at 0x1003aba0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.10127960
mov eax, dword [0x1014200c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x10147b3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10143b24], 0xffffffff
je 0x1003acce
cmp byte [0x10147b58], 0
je 0x1003acce
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2004]
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x10147b30]
add esp, 0xc
test ecx, ecx
jle 0x1003ac17
lea eax, [ecx + esi]
cmp eax, 0x2000
jg 0x1003aca5
push esi
lea eax, [ebp - 0x2004]
push eax
jmp 0x1003ac71
xor edi, edi
test esi, esi
jle 0x1003ac86
nop dword [eax]
push 0
lea eax, [ebp - 0x2004]
add eax, edi
push esi
push eax
push dword [0x10143b24]
mov dword [ebp - 0x2008], eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1003ac4d
sub esi, eax
add edi, eax
test esi, esi
jg 0x1003ac20
jmp 0x1003ac86
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1003aca5
mov ecx, dword [0x10147b30]
lea eax, [ecx + esi]
cmp eax, 0x2000
jg 0x1003aca5
push esi
push dword [ebp - 0x2008]
lea eax, [ecx + 0x10145b30]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [0x10147b30], esi
push 0x10147b3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d9dfe
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x10143b20
call fcn.1003ab40
push 0x10147b3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d9dfe
mov esp, ebp
pop ebp
ret 8
push 0x10147b3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.100d9dfe
mov esp, ebp
pop ebp
ret 8
Function at 0x10040c90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
movd xmm1, dword [0x102c4ab8]
mov edx, ecx
movss xmm0, dword [0x1018d628]
mov eax, dword [0x102c4ac0]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10040d15
comiss xmm1, dword [0x1018d630]
ja 0x10040d15
movss xmm0, dword [0x1018d62c]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
comiss xmm0, xmm2
ja 0x10040d15
comiss xmm2, dword [0x1018d634]
ja 0x10040d15
cmp edx, 0x201
jne 0x10040ceb
mov byte [0x1018d63c], 1
pop ebp
ret 4
mov eax, dword [ebp + 8]
sub eax, dword [0x1018d638]
mov byte [0x1018d63c], 0
cmp eax, 0x1f4
jb 0x10040e83
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1018d638], eax
pop ebp
ret 4
movss xmm0, dword [0x1018d668]
comiss xmm0, xmm1
ja 0x10040d85
comiss xmm1, dword [0x1018d670]
ja 0x10040d85
movss xmm0, dword [0x1018d66c]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
comiss xmm0, xmm2
ja 0x10040d85
comiss xmm2, dword [0x1018d674]
ja 0x10040d85
cmp edx, 0x201
jne 0x10040d5b
mov byte [0x1018d67c], 1
pop ebp
ret 4
mov eax, dword [ebp + 8]
sub eax, dword [0x1018d678]
mov byte [0x1018d67c], 0
cmp eax, 0x1f4
jb 0x10040e83
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1018d678], eax
pop ebp
ret 4
movss xmm0, dword [0x1018d6a8]
comiss xmm0, xmm1
ja 0x10040df5
comiss xmm1, dword [0x1018d6b0]
ja 0x10040df5
movss xmm0, dword [0x1018d6ac]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10040df5
comiss xmm1, dword [0x1018d6b4]
ja 0x10040df5
cmp edx, 0x201
jne 0x10040dcb
mov byte [0x1018d6bc], 1
pop ebp
ret 4
mov eax, dword [ebp + 8]
sub eax, dword [0x1018d6b8]
mov byte [0x1018d6bc], 0
cmp eax, 0x1f4
jb 0x10040e83
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1018d6b8], eax
pop ebp
ret 4
push 0x43
mov ecx, 0x1018c580
call fcn.10076590
test al, al
je 0x10040e3e
cmp edx, 0x201
jne 0x10040e18
mov byte [0x1018d6fc], 1
pop ebp
ret 4
mov eax, dword [ebp + 8]
sub eax, dword [0x1018d6f8]
mov byte [0x1018d6fc], 0
cmp eax, 0x1f4
jb 0x10040e83
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1018d6f8], eax
pop ebp
ret 4
push 0x44
mov ecx, 0x1018c580
call fcn.10076590
test al, al
je 0x10040e83
cmp edx, 0x201
jne 0x10040e61
mov byte [0x1018d73c], 1
pop ebp
ret 4
mov eax, dword [ebp + 8]
sub eax, dword [0x1018d738]
mov byte [0x1018d73c], 0
cmp eax, 0x1f4
jb 0x10040e83
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1018d738], eax
pop ebp
ret 4
Function at 0x10041a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1018cdb8]
cmp eax, 0x5dc
jb 0x10041a9f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x1018cdbd], 1
mov dword [0x1018cdb8], eax
jne 0x10041a3a
mov byte [0x1018cdbd], 0
mov esp, ebp
pop ebp
ret
mov eax, 0x102fd4e4
nop
mov dword [eax], 0xffffffff
add eax, 8
cmp eax, 0x102fd634
jl 0x10041a40
mov edx, 4
mov dword [0x102fcda4], 0
lea ecx, [ebp - 4]
mov dword [0x102fcd9c], 0
mov dword [ebp - 4], 0xe8f304c1
call fcn.100c5f00
cmp dword [0x101ef0a0], 2
jne 0x10041a8e
mov eax, dword [0x10520790]
mov byte [eax + 0x29], 1
mov esp, ebp
pop ebp
ret
mov byte [0x1018cdbd], 1
mov dword [0x1017d1d0], 1
mov esp, ebp
pop ebp
ret
Function at 0x10041f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1014aa78]
mov eax, edx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [eax + 4]
push edi
cmp byte [ecx + 0xd], 0
jne 0x10041f74
nop word [eax + eax]
cmp dword [ecx + 0x10], ebx
jge 0x10041f6a
mov ecx, dword [ecx + 8]
jmp 0x10041f6e
mov eax, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x10041f60
cmp eax, edx
je 0x10041f7d
cmp ebx, dword [eax + 0x10]
jge 0x10041f7f
mov eax, edx
xor edx, edx
mov ecx, 0x10147b94
cmp edx, 0xc7
ja 0x10041f9b
cmp dword [ecx], edx
jne 0x10041f9b
test ecx, ecx
je 0x10041f9b
cmp dword [ecx + 4], ebx
je 0x10041fa9
add ecx, 0x3c
inc edx
cmp ecx, 0x1014aa74
jl 0x10041f86
xor ecx, ecx
xor esi, esi
mov edx, 0x101a4cf4
cmp esi, 0x63
ja 0x10041fc2
cmp dword [edx], esi
jne 0x10041fc2
test edx, edx
je 0x10041fc2
cmp dword [edx + 4], ebx
je 0x10041fd0
add edx, 0x34
inc esi
cmp edx, 0x101a6144
jl 0x10041fb0
xor edx, edx
xor edi, edi
mov esi, 0x101529f4
cmp edi, 0x31
ja 0x10041fe9
cmp dword [esi], edi
jne 0x10041fe9
test esi, esi
je 0x10041fe9
cmp dword [esi + 4], ebx
je 0x10041ff7
add esi, 0x7c
inc edi
cmp esi, 0x1015422c
jl 0x10041fd7
xor esi, esi
cmp eax, dword [0x1014aa78]
je 0x10042048
movd xmm0, dword [eax + 0x1c]
movss xmm1, dword [0x101390c0]
cvtdq2ps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
divss xmm0, xmm1
movss dword [ecx], xmm0
movd xmm0, dword [eax + 0x20]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [ecx + 4], xmm0
movd xmm0, dword [eax + 0x24]
mov eax, 1
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [ecx + 8], xmm0
pop ebp
ret 8
test ecx, ecx
je 0x10042095
movd xmm0, dword [ecx + 0x30]
movss xmm1, dword [0x101390c0]
cvtdq2ps xmm0, xmm0
mov eax, dword [ebp + 0xc]
divss xmm0, xmm1
movss dword [eax], xmm0
movd xmm0, dword [ecx + 0x34]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [eax + 4], xmm0
movd xmm0, dword [ecx + 0x38]
cvtdq2ps xmm0, xmm0
pop edi
pop esi
pop ebx
divss xmm0, xmm1
movss dword [eax + 8], xmm0
mov eax, 1
pop ebp
ret 8
test edx, edx
je 0x100420cc
movd xmm0, dword [edx + 0x28]
movss xmm1, dword [0x101390c0]
cvtdq2ps xmm0, xmm0
mov eax, dword [ebp + 0xc]
divss xmm0, xmm1
movss dword [eax], xmm0
movd xmm0, dword [edx + 0x2c]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [eax + 4], xmm0
movd xmm0, dword [edx + 0x30]
jmp 0x1004207d
test esi, esi
je 0x10042106
movd xmm0, dword [esi + 0x70]
movss xmm1, dword [0x101390c0]
cvtdq2ps xmm0, xmm0
mov eax, dword [ebp + 0xc]
divss xmm0, xmm1
movss dword [eax], xmm0
movd xmm0, dword [esi + 0x74]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [eax + 4], xmm0
movd xmm0, dword [esi + 0x78]
jmp 0x1004207d
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x10044050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1018cdb8]
cmp eax, 0x5dc
jb 0x100440fd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x1018cdbd], 1
mov dword [0x1018cdb8], eax
jne 0x1004408c
mov byte [0x1018cdbd], 0
mov esp, ebp
pop ebp
ret
mov ecx, 0x102fd640
call fcn.100439e0
mov edx, 4
mov dword [0x102fd648], 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xe7f304c1
call fcn.100c5f00
mov edx, 5
mov dword [ebp - 8], 0xe6f305c1
lea ecx, [ebp - 8]
mov dword [0x102fd640], 0
mov byte [ebp - 4], 0
call fcn.100c5f00
cmp dword [0x101ef0a0], 2
jne 0x100440ec
mov eax, dword [0x1052079c]
mov byte [eax + 0x29], 1
mov esp, ebp
pop ebp
ret
mov byte [0x1018cdbd], 1
mov dword [0x1017d1d0], 3
mov esp, ebp
pop ebp
ret
Function at 0x1005e4e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.._Settings.ini
push 0x64
push 0x102c1af0
push str.Tahoma
push str.FontName
push str.FontConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x1005e720
push 0x4060d0
push 0xe8
call fcn.100caf90
push fcn.1005e6a0
push 0x4d2882
push 0xe8
call fcn.100caf90
push 0x1005e720
push 0x4d28eb
push 0xe8
call fcn.100caf90
push 0x1005e720
push 0x4d2957
push 0xe8
call fcn.100caf90
push fcn.1005e6a0
push 0x4d29c1
push 0xe8
call fcn.100caf90
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
add esp, 0x3c
push eax
push 0x40
push 1
push 0x4060d5
call esi
lea eax, [ebp - 4]
mov byte [0x4060d5], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4060d5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
mov byte [0x4d2887], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
mov byte [0x4d28f0], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
mov byte [0x4d295c], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d29c6
call esi
lea eax, [ebp - 4]
mov byte [0x4d29c6], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4d29c6
call esi
cmp dword [0x102fcd88], 1
pop esi
push 0x102c1af0
push 0
push dword [0x10520840]
push 0
push 0
jne 0x1005e650
push 1
jmp 0x1005e652
push 0
push dword [0x10520844]
push dword [0x1052064c]
push dword [0x102fab1c]
push 0x2bc
push 0
push 0
push dword [0x102fcd8c]
push dword [0x102fab18]
call dword [sym.imp.GDI32.dll_CreateFontA]
mov ecx, 0x102fa908
mov dword [0x102fa9f8], eax
call fcn.1005e6a0
mov dword [0x102fa9fc], eax
mov esp, ebp
pop ebp
ret
Function at 0x10060aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, 3
mov word [ebp - 4], 0xcffc
sub eax, ecx
mov byte [ebp - 2], 0xab
push edi
mov dword [ebp - 8], eax
mov edi, 1
mov ebx, 2
mov eax, 4
xor esi, esi
sub edi, ecx
sub ebx, ecx
sub eax, ecx
mov dword [ebp - 0xc], eax
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
lea eax, [edx + edx*2]
mov edx, esi
sub edx, eax
movzx eax, byte [ebp + edx - 4]
lea edx, [edi + ecx]
xor byte [ecx], al
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, esi
sub edx, eax
movzx eax, byte [ebp + edx - 3]
lea edx, [ebx + ecx]
xor byte [ecx + 1], al
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, esi
sub edx, eax
movzx eax, byte [ebp + edx - 2]
xor byte [ecx + 2], al
mov eax, 0xaaaaaaab
mov edx, dword [ebp - 8]
lea edx, [edx + ecx]
mul edx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, esi
sub edx, eax
movzx eax, byte [ebp + edx - 1]
xor byte [ecx + 3], al
mov eax, 0xaaaaaaab
mov edx, dword [ebp - 0xc]
lea edx, [edx + ecx]
mul edx
lea ecx, [ecx + 5]
shr edx, 1
lea eax, [edx + edx*2]
mov edx, esi
sub edx, eax
add esi, 5
movzx eax, byte [ebp + edx]
xor byte [ecx - 1], al
cmp esi, 0x6e
jl 0x10060ad7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100668f0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1014200c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov edi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push esi
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push edi
call dword [sym.imp.USER32.dll_ToAsciiEx]
pop edi
pop esi
cmp eax, 1
jne 0x1006695c
mov ax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d9dfe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100d9dfe
mov esp, ebp
pop ebp
ret
Function at 0x10069630
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x102bbb70], 0
movaps xmm6, xmm3
movss xmm5, dword [0xe7c3d4]
movaps xmm7, xmm2
movss xmm3, dword [ebp + 8]
movss dword [ebp - 0x10], xmm6
movss dword [ebp - 0x14], xmm7
movss dword [ebp - 4], xmm1
jne 0x10069690
movd xmm0, dword [0xe61e5c]
movd xmm4, dword [0xe61e58]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm4, xmm4
mulss xmm0, dword [0x101383f0]
divss xmm4, xmm0
movaps xmm0, xmm3
divss xmm0, xmm5
mulss xmm4, xmm0
jmp 0x10069697
movaps xmm4, xmm3
divss xmm4, xmm5
mov edx, dword [0x879340c]
cvttss2si eax, xmm1
movsx ecx, ax
cmp edx, ecx
jl 0x100697cf
movaps xmm0, xmm6
divss xmm0, xmm5
cvttss2si eax, xmm0
cwde
add eax, ecx
cmp edx, eax
jg 0x100697cf
mov edx, dword [0x8793410]
cvttss2si eax, xmm7
movsx ecx, ax
cmp edx, ecx
jl 0x100697cf
cvttss2si eax, xmm4
cwde
add eax, ecx
cmp edx, eax
jg 0x100697cf
movaps xmm0, xmm3
divss xmm0, dword [ebp + 0x10]
push 1
movss dword [ebp - 8], xmm0
movaps xmm0, xmm6
divss xmm0, dword [ebp + 0xc]
movss dword [ebp - 0xc], xmm0
call dword [sym.imp.USER32.dll_GetKeyState]
movss xmm2, dword [ebp - 8]
mov ecx, 0x8000
movss xmm0, dword [ebp - 0xc]
push ecx
mov dword [esp], 0
push 1
push 0
sub esp, 0x20
test cx, ax
mov eax, 0x637c60
movss dword [esp + 0x1c], xmm2
movss dword [esp + 0x18], xmm0
je 0x1006974f
cvtps2pd xmm1, xmm2
addsd xmm1, xmm1
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x14], xmm0
jmp 0x10069755
movss dword [esp + 0x14], xmm2
movss xmm0, dword [ebp + 8]
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp - 0x10]
movss dword [esp + 8], xmm0
movss xmm0, dword [ebp - 0x14]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 4]
movss dword [esp], xmm0
push 0x799c
call eax
add esp, 0x30
mov eax, 0x791050
push 1
call eax
add esp, 4
test al, al
je 0x100697c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x10545544]
add ecx, 0x96
cmp ecx, eax
ja 0x100697c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10545544], eax
mov al, 2
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
movaps xmm1, xmm3
movss xmm0, dword [ebp - 4]
divss xmm1, dword [ebp + 0x10]
mov eax, 0x637c60
push ecx
mov dword [esp], 0
push 1
push 0
sub esp, 0x20
movaps xmm2, xmm6
divss xmm2, dword [ebp + 0xc]
movss dword [esp + 0x1c], xmm1
movss dword [esp + 0x18], xmm2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm3
movss dword [esp + 8], xmm6
movss dword [esp + 4], xmm7
movss dword [esp], xmm0
push 0x799c
call eax
add esp, 0x30
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10069840
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov esi, edx
push eax
push 0
push 0xf003f
mov ebx, dword [esi + 0x10]
mov edi, ecx
push 0
push 0
push 0
push str.SOFTWAREWebzenMuConfig
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10069889
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 0x10
jb 0x10069891
mov esi, dword [esi]
cmp dword [edi + 0x14], 0x10
jb 0x10069899
mov edi, dword [edi]
push ebx
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006bbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1014200c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREWebzenMuConfig
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1006bd6f
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
mov dword [0x10545548], eax
nop dword [eax]
test esi, esi
je 0x1006bc1b
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x38]
push str.ID__d
push eax
call sym.Main.dll_sprintf
add esp, 0xc
jmp 0x1006bc2c
lea eax, [ebp - 0x38]
push 0x10136040
push eax
call sym.Main.dll_sprintf
add esp, 8
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xb
push eax
mov eax, dword [0x10545548]
lea ecx, [eax*8]
sub ecx, eax
lea eax, [ecx*4 + 0x1054554c]
push eax
push 0
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x40]
call edi
test eax, eax
jne 0x1006bd1b
cmp dword [ebp - 0x3c], 1
jb 0x1006bd1b
test esi, esi
je 0x1006bc87
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x38]
push str.PW__d
push eax
call sym.Main.dll_sprintf
add esp, 0xc
jmp 0x1006bc98
lea eax, [ebp - 0x38]
push 0x10136044
push eax
call sym.Main.dll_sprintf
add esp, 8
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xb
push eax
mov eax, dword [0x10545548]
lea ecx, [eax*8]
sub ecx, eax
lea eax, [ecx*4 + 0x10545557]
push eax
push 0
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x40]
call edi
test eax, eax
jne 0x1006bced
cmp dword [ebp - 0x3c], 1
jb 0x1006bced
mov eax, dword [0x10545548]
lea ecx, [eax*8]
sub ecx, eax
mov dword [ecx*4 + 0x10545564], esi
inc dword [0x10545548]
jmp 0x1006bd47
mov eax, dword [0x10545548]
xorps xmm0, xmm0
lea ecx, [eax*8]
sub ecx, eax
movq qword [ecx*4 + 0x10545557], xmm0
mov word [ecx*4 + 0x1054555f], 0
mov byte [ecx*4 + 0x10545561], 0
jmp 0x1006bd47
mov eax, dword [0x10545548]
xorps xmm0, xmm0
lea ecx, [eax*8]
sub ecx, eax
movq qword [ecx*4 + 0x1054554c], xmm0
mov word [ecx*4 + 0x10545554], 0
mov byte [ecx*4 + 0x10545556], 0
inc esi
cmp esi, 5
jl 0x1006bc00
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 4
push eax
push 0x10545500
push 0
push 0
push str.SavePass
push dword [ebp - 0x40]
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x10545500], 1
pop esi
call fcn.100d9dfe
mov esp, ebp
pop ebp
ret
Function at 0x100718e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1018c57c]
add eax, 0xffffffff
mov dword [0x1018c57c], eax
jns 0x10071a29
push ebx
push esi
mov esi, 0x1018bbbc
push edi
mov edi, 0x1018bbb4
cmp eax, 0xffffffff
jge 0x10071931
mov eax, 0x1105
mov ecx, 0x1018bbb8
mov dword [0x1018bbb4], eax
mov edx, 0x26f
nop dword [eax]
imul eax, eax, 0x10dcd
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
sub edx, 1
jne 0x10071920
mov eax, dword [0x1018bbb4]
mov ebx, 0xe3
mov edx, dword [0x1018bbb8]
mov dword [0x1018c57c], 0x26f
mov dword [0x1018c578], 0x1018bbb8
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [esi + 0x62c]
mov dword [edi], ecx
add edi, 4
mov edx, dword [esi]
add esi, 4
sub ebx, 1
jne 0x10071955
mov ebx, 0x1018bbb4
mov dword [ebp - 4], 0x18c
mov ecx, edx
lea ebx, [ebx + 4]
xor ecx, eax
lea edi, [edi + 4]
and ecx, 0x7ffffffe
lea esi, [esi + 4]
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx - 4]
sub dword [ebp - 4], 1
mov dword [edi - 4], ecx
mov edx, dword [esi - 4]
jne 0x10071998
mov edx, dword [0x1018bbb4]
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx]
shr eax, 0xb
xor edx, eax
mov dword [edi], ecx
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
pop edi
mov eax, edx
shr eax, 0x12
pop esi
xor eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1018c578]
mov ecx, dword [eax]
add eax, 4
mov dword [0x1018c578], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x10076ff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
movd xmm1, dword [0x102c4ab8]
push esi
mov esi, dword [ebp + 0xc]
shl esi, 6
cvtdq2ps xmm1, xmm1
push edi
mov edi, ecx
movss xmm0, dword [esi + 0x1018c628]
comiss xmm0, xmm1
ja 0x10077079
comiss xmm1, dword [esi + 0x1018c630]
ja 0x10077079
movd xmm1, dword [0x102c4ac0]
movss xmm0, dword [esi + 0x1018c62c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10077079
comiss xmm1, dword [esi + 0x1018c634]
ja 0x10077079
cmp byte [ebp + 0x10], 1
jne 0x1007704f
cmp byte [esi + edi + 0xbe], 0
je 0x10077079
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + edi + 0xb8]
mov ecx, dword [ebp + 8]
cmp ecx, 0x201
jne 0x10077081
cmp byte [esi + edi + 0xbc], 0
jne 0x10077079
mov byte [esi + edi + 0xbc], 1
pop edi
xor al, al
pop esi
pop ebp
ret 0xc
cmp ecx, 0x202
jne 0x10077079
cmp eax, 0x1f4
jb 0x10077079
mov byte [esi + edi + 0xbc], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + edi + 0xb8], eax
mov al, 1
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1008ca40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov edx, 0x101324e7
push edi
lea edi, [esi + 0xc]
mov dword [esi], vtable.CLuaDecrypt.0
mov eax, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x1008ca77
test cl, cl
je 0x1008ca73
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x1008ca77
add eax, 2
add edx, 2
test cl, cl
jne 0x1008ca57
xor eax, eax
jmp 0x1008ca7c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1008cab1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1008cab1
push dword [esi + 4]
call fcn.100da476
push 0x100
push 0
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
test byte [ebp + 8], 1
je 0x1008cac5
push 0x10c
push esi
call fcn.100d9e0f
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
ret 4