joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020820
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x10014020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10020917
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10013200
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10020930
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x1001d0c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10060d4c], eax
cmp dword [0x10060d4c], 0
jne 0x10020a2c
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10013200
mov eax, dword [0x10060d4c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10020a40
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x1001ffd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10060d58], eax
cmp dword [0x10060d58], 0
jne 0x10020b3c
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10013200
mov eax, dword [0x10060d58]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10020c60
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100493c3
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov eax, dword [0x10060d4c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xcc], eax
push 0
mov ecx, dword [0x10060d50]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xd0], eax
push 0
mov edx, dword [0x10060d54]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xd4], eax
push 0
mov eax, dword [0x10060d58]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xd8], eax
mov ecx, dword [0x10060d4c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xe4], eax
mov edx, dword [0x10060d50]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xe8], eax
mov eax, dword [0x10060d54]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xec], eax
mov ecx, dword [0x10060d58]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xcc], 0x102
jne 0x10020d58
cmp dword [ebp - 0xd0], 0x102
jne 0x10020d58
cmp dword [ebp - 0xd4], 0x102
jne 0x10020d58
cmp dword [ebp - 0xd8], 0x102
je 0x10020da1
push 0x5856b519
lea ecx, [ebp - 0x6c]
call fcn.100203e0
mov dword [ebp - 0xdc], eax
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xe0], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xe0]
push eax
call fcn.10012fb0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1001f390
call fcn.10013200
cmp dword [ebp - 0xe4], 1
je 0x10020dc5
cmp dword [ebp - 0xe8], 1
je 0x10020dc5
cmp dword [ebp - 0xec], 1
je 0x10020dc5
cmp dword [ebp - 0xf0], 1
jne 0x10020e15
mov ecx, 0x9ceb4d5
push ecx
lea ecx, [ebp - 0xc8]
call fcn.10020460
mov dword [ebp - 0xf4], eax
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xf8]
push eax
call fcn.10012fb0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.1001f390
call fcn.10013200
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x1002339a
Capabilities:
Create thread

Disassembly:
jae 0x10023398
jmp 0x10023393
call fcn.1002339a
jae 0x10023393
add esp, 4
jmp 0x1002339f
dec dword [esp]
jno 0x100233a4
jns 0x1002338f
jp 0x100233a8
add esp, 4
popf
jmp 0x100233af
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100233c8
jne 0x100233c8
call 0x1fc2671c
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10023550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x38], eax
clc
jae 0x100233f6
pop ss
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10023403
jmp 0x100233fe
call 0x10023405
jae 0x100233fe
add esp, 4
jmp 0x1002340a
dec dword [esp]
jno 0x1002340f
jns 0x100233fa
jp 0x10023413
add esp, 4
popf
jmp 0x1002341a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10023433
jne 0x10023433
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x10023438
jmp 0x1002343a
je 0x10023435
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10023454
jne 0x10023453
call 0x930624db
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10023462
jne 0x10023462
call 0x10cab1e9
cmp dword [ebp - 0x38], 0
jne 0x10023531
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10013200
mov eax, dword [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10023405
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10023398
jmp 0x10023393
call fcn.1002339a
jae 0x10023393
add esp, 4
jmp 0x1002339f
dec dword [esp]
jno 0x100233a4
jns 0x1002338f
jp 0x100233a8
add esp, 4
popf
jmp 0x100233af
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100233c8
jne 0x100233c8
call 0x1fc2671c
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10023550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x38], eax
clc
jae 0x100233f6
pop ss
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10023403
jmp 0x100233fe
call 0x10023405
jae 0x100233fe
add esp, 4
jmp 0x1002340a
dec dword [esp]
jno 0x1002340f
jns 0x100233fa
jp 0x10023413
add esp, 4
popf
jmp 0x1002341a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10023433
jne 0x10023433
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x10023438
jmp 0x1002343a
je 0x10023435
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10023454
jne 0x10023453
call 0x930624db
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10023462
jne 0x10023462
call 0x10cab1e9
cmp dword [ebp - 0x38], 0
jne 0x10023531
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10013200
mov eax, dword [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10024cb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10024e60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10024d7d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1005f888]
jb 0x10024cfa
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005f88c]
ja 0x10024cfa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10024cca
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1002a950
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10024d20
jmp 0x10024d7d
cmp dword [ebp - 0x14], 0x10000
jne 0x10024d63
cmp dword [ebp - 0x18], 0x10000
jb 0x10024d63
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10024d56
mov eax, dword [ebp - 8]
jmp 0x10024d7f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10024d78
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10024e60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10024cca
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10024d90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10024e90
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10024e55
mov edx, dword [ebp - 4]
cmp edx, dword [0x1005f888]
jb 0x10024dd5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005f88c]
ja 0x10024dd5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10024da5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1002a950
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10024dfb
jmp 0x10024e55
cmp dword [ebp - 0x14], 0x10000
jne 0x10024e3e
cmp dword [ebp - 0x18], 0x10000
jb 0x10024e3e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10024e31
mov eax, dword [ebp - 8]
jmp 0x10024e57
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10024e50
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10024e90
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10024da5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10024ec0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100252b0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10060d94], 0
jne 0x10024efd
cmp dword [0x10060d90], 0
je 0x10024efd
mov eax, dword [0x10060d90]
mov dword [0x10060d94], eax
cmp dword [0x10060d94], 0
je 0x10024f7a
mov ecx, dword [0x10060d94]
cmp dword [ecx + 8], 0
je 0x10024f7a
mov edx, dword [0x10060d94]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10024f7a
mov ecx, dword [0x10060d94]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10024f7a
mov eax, dword [0x10060d94]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10024f49
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10024f50
xor eax, eax
jmp 0x10025099
mov ecx, dword [0x10060d94]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1002a950
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10025099
mov edx, dword [0x10060d90]
mov dword [0x10060d94], edx
jmp 0x10024f96
mov eax, dword [0x10060d94]
mov ecx, dword [eax + 4]
mov dword [0x10060d94], ecx
cmp dword [0x10060d94], 0
je 0x10024fd6
cmp dword [0x10060d94], 0
je 0x10024fd4
mov edx, dword [0x10060d94]
cmp dword [edx + 8], 0
je 0x10024fd4
mov eax, dword [0x10060d94]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10024fd4
mov edx, dword [0x10060d94]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10024fd4
jmp 0x10024f2e
jmp 0x10024f88
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100250a0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10025097
mov eax, dword [ebp - 0x18]
mov dword [0x10060d94], eax
mov ecx, dword [0x10060d94]
mov dword [ecx], 0x52727464
mov edx, dword [0x10060d94]
mov dword [edx + 8], 0
mov eax, dword [0x10060d94]
mov ecx, dword [0x10060d90]
mov dword [eax + 4], ecx
mov edx, dword [0x10060d94]
mov dword [0x10060d90], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10060d94]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10025067
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10025087
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1002505e
mov eax, dword [0x10060d94]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10024f2e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003a71b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003a591
Function at 0x40489c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004074d4
test esi, esi
jne 0x4048d2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040765c
jmp 0x4048f0
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004047e0
mov edi, eax
test esi, esi
je 0x4048f0
cmp dword [ebx], 0
je 0x4048f0
dec esi
jmp 0x4048d9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404924
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x61f008], 0x8088405
inc edx
mov dword [ebx + 0x61f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4061f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004065f0
mov byte [esp], al
cmp byte [esp], 0
jne 0x406384
test edi, edi
je 0x406384
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4062bb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x406296
cmp edi, 0xffffffff
je 0x406257
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x406257
mov byte [esp], 0
jmp 0x406384
mov ebx, dword [esi]
cmp ebx, 1
jg 0x406296
test ebx, ebx
jne 0x40628c
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402784
test eax, eax
jne 0x40628c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406384
call 0x406714
dec ebp
test ebp, ebp
jg 0x40623c
cmp edi, 0xffffffff
je 0x4062bb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4062b9
mov byte [esp], 0
jmp 0x406384
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x406206
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x4062bb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004063f4
mov edx, eax
mov ebx, dword [0x63c8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x406322
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x406320
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x406322
xor edi, edi
cmp byte [esp], 0
je 0x40634b
mov ebx, dword [esi]
test bl, 1
jne 0x406364
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x406328
mov byte [esp + 1], 1
jmp 0x406364
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x40634b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4062d5
cmp byte [esp], 0
je 0x406384
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x407130
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x63c058], 0
je 0x407197
cmp word [0x63c344], 0xd7b2
jne 0x407159
cmp dword [0x63c34c], 0
jbe 0x407159
mov eax, 0x63c340
call dword [0x63c35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4071c4
call fcn.00407f88
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x61f032], 0
jne 0x4071b3
push 0
push 0x61f9ca
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x407390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x61f034], 0
je 0x4073bb
mov edx, edi
mov eax, esi
call dword [0x61f034]
mov ebx, eax
jmp 0x4073cc
mov eax, 8
call fcn.0040451c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x63c059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x407358
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x407401
mov edx, 8
mov eax, ebx
call fcn.00404538
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc