joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000eb10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f61dc]
mov ecx, dword [0x101fcab4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1000eb99
comiss xmm1, dword [0x101f61e4]
ja 0x1000eb99
movss xmm0, dword [0x101f61e0]
movd xmm2, ecx
cvtdq2ps xmm2, xmm2
comiss xmm0, xmm2
ja 0x1000eb99
comiss xmm2, dword [0x101f61e8]
ja 0x1000eb99
cmp dword [ebp + 8], 0x201
jne 0x1000eb75
mov byte [0x101f61f0], 1
pop esi
pop ebp
ret 4
sub eax, dword [0x101f61ec]
mov byte [0x101f61f0], 0
cmp eax, 0x1f4
jb 0x1000ec64
call esi
mov dword [0x101f61ec], eax
pop esi
pop ebp
ret 4
movss xmm0, dword [0x101f6224]
comiss xmm0, xmm1
ja 0x1000ec01
comiss xmm1, dword [0x101f622c]
ja 0x1000ec01
movss xmm0, dword [0x101f6228]
movd xmm2, ecx
cvtdq2ps xmm2, xmm2
comiss xmm0, xmm2
ja 0x1000ec01
comiss xmm2, dword [0x101f6230]
ja 0x1000ec01
cmp dword [ebp + 8], 0x201
jne 0x1000ebe1
mov byte [0x101f6238], 1
pop esi
pop ebp
ret 4
sub eax, dword [0x101f6234]
mov byte [0x101f6238], 0
cmp eax, 0x1f4
jb 0x1000ec64
call esi
mov dword [0x101f6234], eax
pop esi
pop ebp
ret 4
movss xmm0, dword [0x101f626c]
comiss xmm0, xmm1
ja 0x1000ec64
comiss xmm1, dword [0x101f6274]
ja 0x1000ec64
movss xmm0, dword [0x101f6270]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1000ec64
comiss xmm1, dword [0x101f6278]
ja 0x1000ec64
cmp dword [ebp + 8], 0x201
jne 0x1000ec49
mov byte [0x101f6280], 1
pop esi
pop ebp
ret 4
sub eax, dword [0x101f627c]
mov byte [0x101f6280], 0
cmp eax, 0x1f4
jb 0x1000ec64
call esi
mov dword [0x101f627c], eax
pop esi
pop ebp
ret 4
Function at 0x10011ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101f525c], 0
jne 0x10012028
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [0x101f5258]
push 0x10012090
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x101f525c], eax
test eax, eax
jne 0x10012028
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, 0x10011e40
mov byte [ebp - 0x10], 0xe8
sub eax, 0x4d0e34
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4d0e2f
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10012082
mov eax, dword [ebp - 0x10]
mov ecx, 0x4d0e2f
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10012088
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10017ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x100146c0
push 0x4d7eb1
push 0xe8
call fcn.10063f10
push 0x10017ad0
push 0x4d76fb
push 0xe8
call fcn.10063f10
push 0x10017ad0
push 0x4d79c3
push 0xe8
call fcn.10063f10
add esp, 0x24
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d75f0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10017d2d
mov eax, 0x4d75f0
mov dword [eax], 5
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 4
push 0x4d75f0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10017d33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x10018880
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x101f6e99], 1
jne 0x1001889b
mov byte [0x101f6e99], 0
mov dword [0xe8cb3c], 0
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f64bc]
cmp eax, 0x5dc
jae 0x100188b6
mov byte [0x101f6e99], 0
ret
mov byte [0x101f6b39], 0
mov dword [0xe8cb3c], 0
mov byte [0x101f65e1], 0
mov dword [0xe8cb3c], 0
mov byte [0x101f64c1], 0
mov byte [0x101f69d1], 0
mov byte [0x101f6e99], 0
mov dword [0xe8cb3c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6e94], eax
mov byte [0x101f6e99], 1
mov dword [0xe8cb3c], 1
ret

Function at 0x10018920
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6ffc]
cmp byte [0x101f6e99], 0
je 0x100189be
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6fec]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100189be
comiss xmm1, dword [0x101f6ff4]
ja 0x100189be
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6ff0]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100189be
comiss xmm1, dword [0x101f6ff8]
ja 0x100189be
cmp dword [ebp + 8], 0x201
jne 0x10018994
mov byte [0x101f7000], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f7000], 0
cmp eax, 0x1f4
jb 0x100189be
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6ffc], eax
mov byte [0x101f6e99], 0
mov dword [0xe8cb3c], 0
xor al, al
pop ebp
ret 4

Function at 0x100189d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub eax, dword [0x101f78fc]
sub ecx, dword [0x101f78b4]
cmp byte [0x101f6e99], 0
je 0x10018a74
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f78a4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10018a74
comiss xmm1, dword [0x101f78ac]
ja 0x10018a74
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f78a8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10018a74
comiss xmm1, dword [0x101f78b0]
ja 0x10018a74
cmp dword [ebp + 8], 0x201
jne 0x10018a4c
mov byte [0x101f78b8], 1
mov al, 1
pop ebp
ret 4
cmp ecx, 0x64
jb 0x10018a74
cmp eax, 0x64
jb 0x10018a74
inc dword [0x10201e58]
mov byte [0x101f78b8], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f78b4], eax
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4
Function at 0x10018a80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub eax, dword [0x101f78b4]
sub ecx, dword [0x101f78fc]
cmp byte [0x101f6e99], 0
je 0x10018b24
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f78ec]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10018b24
comiss xmm1, dword [0x101f78f4]
ja 0x10018b24
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f78f0]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10018b24
comiss xmm1, dword [0x101f78f8]
ja 0x10018b24
cmp dword [ebp + 8], 0x201
jne 0x10018afc
mov byte [0x101f7900], 1
mov al, 1
pop ebp
ret 4
cmp ecx, 0x64
jb 0x10018b24
cmp eax, 0x64
jb 0x10018b24
mov byte [0x101f7900], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec dword [0x10201e58]
mov dword [0x101f78fc], eax
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4
Function at 0x100195f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6a5c]
cmp byte [0x101f69d1], 0
je 0x1001968e
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6a4c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001968e
comiss xmm1, dword [0x101f6a54]
ja 0x1001968e
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6a50]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001968e
comiss xmm1, dword [0x101f6a58]
ja 0x1001968e
cmp dword [ebp + 8], 0x201
jne 0x10019664
mov byte [0x101f6a60], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6a60], 0
cmp eax, 0x1f4
jb 0x1001968e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6a5c], eax
mov byte [0x101f69d1], 0
mov dword [0xe8cb3c], 0
xor al, al
pop ebp
ret 4

Function at 0x100196a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x15
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x100197a5
push 0x21
call esi
mov ecx, eax
call edi
test al, al
jne 0x100197a5
push 1
call esi
mov ecx, eax
call edi
test al, al
jne 0x100197a5
push 0x49
call esi
mov ecx, eax
call edi
test al, al
jne 0x100197a5
push 0x4f
call esi
mov ecx, eax
call edi
test al, al
jne 0x100197a5
push 0xe
call esi
mov ecx, eax
call edi
test al, al
jne 0x100197a5
push 8
call fcn.10039dd0
test al, al
jne 0x100197a5
push 7
call fcn.10039dd0
test al, al
jne 0x100197a5
push 0x41
call fcn.10039dd0
test al, al
jne 0x100197a5
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101f69cc]
cmp eax, 0x3e8
jb 0x100197a5
call esi
cmp byte [0x101f69d1], 1
mov dword [0x101f69cc], eax
jne 0x10019771
pop edi
mov byte [0x101f69d1], 0
mov dword [0xe8cb3c], 0
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x101f5d40
call fcn.1003c2b0
call fcn.10018b80
mov edx, 4
mov dword [ebp - 4], 0xe8f304c1
lea ecx, [ebp - 4]
call fcn.1005d410
mov byte [0x101f69d1], 1
mov dword [0xe8cb3c], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100197b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub eax, dword [0x101f798c]
sub ecx, dword [0x101f7944]
cmp byte [0x101f69d1], 0
je 0x10019854
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f7934]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10019854
comiss xmm1, dword [0x101f793c]
ja 0x10019854
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f7938]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10019854
comiss xmm1, dword [0x101f7940]
ja 0x10019854
cmp dword [ebp + 8], 0x201
jne 0x1001982c
mov byte [0x101f7948], 1
mov al, 1
pop ebp
ret 4
cmp ecx, 0x64
jb 0x10019854
cmp eax, 0x64
jb 0x10019854
inc dword [0x10202b70]
mov byte [0x101f7948], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f7944], eax
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4
Function at 0x10019860
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub eax, dword [0x101f7944]
sub ecx, dword [0x101f798c]
cmp byte [0x101f69d1], 0
je 0x10019904
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f797c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10019904
comiss xmm1, dword [0x101f7984]
ja 0x10019904
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f7980]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10019904
comiss xmm1, dword [0x101f7988]
ja 0x10019904
cmp dword [ebp + 8], 0x201
jne 0x100198dc
mov byte [0x101f7990], 1
mov al, 1
pop ebp
ret 4
cmp ecx, 0x64
jb 0x10019904
cmp eax, 0x64
jb 0x10019904
mov byte [0x101f7990], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec dword [0x10202b70]
mov dword [0x101f798c], eax
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x1001d260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push ecx
mov edx, 4
mov ecx, 0x7e7827
call fcn.10063b20
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov eax, 0x1001bfa0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x7e782c
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x7e7827
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001d2d9
mov eax, dword [ebp - 0x10]
mov ecx, 0x7e7827
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1001d2db
call esi
push ecx
mov edx, 0xa
mov ecx, 0x5f479e
call fcn.10063b20
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1001c9f0
mov dword [ebp - 4], 0
sub eax, 0x5f47a3
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5f479e
call edi
test eax, eax
je 0x1001d340
mov eax, dword [ebp - 0x10]
mov ecx, 0x5f479e
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1001d342
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001d6a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push ecx
mov edx, 7
mov ecx, 0x608cac
call fcn.10063b20
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov eax, 0x1001d4e0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x608cb1
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x608cac
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001d719
mov eax, dword [ebp - 0x10]
mov ecx, 0x608cac
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1001d71b
call esi
push ecx
mov edx, 7
mov ecx, 0x60954d
call fcn.10063b20
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1001d570
mov dword [ebp - 4], 0
sub eax, 0x609552
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x60954d
call edi
test eax, eax
je 0x1001d780
mov eax, dword [ebp - 0x10]
mov ecx, 0x60954d
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1001d782
call esi
push ecx
mov edx, 7
mov ecx, 0x60f04c
call fcn.10063b20
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1001d600
mov dword [ebp - 4], 0
sub eax, 0x60f051
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x60f04c
call edi
test eax, eax
je 0x1001d7e7
mov eax, dword [ebp - 0x10]
mov ecx, 0x60f04c
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1001d7e9
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001efe0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, al
je 0x1001f09d
call esi
sub eax, dword [0x101f8004]
cmp byte [0x101f8099], 0
je 0x1001f12d
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f7ff4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001f12d
comiss xmm1, dword [0x101f7ffc]
ja 0x1001f12d
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f7ff8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001f12d
comiss xmm1, dword [0x101f8000]
ja 0x1001f12d
cmp dword [ebp + 8], 0x201
jne 0x1001f082
mov byte [0x101f8008], 1
mov al, 1
pop esi
pop ebp
ret 4
mov byte [0x101f8008], 0
cmp eax, 0x1f4
jb 0x1001f12d
call esi
mov dword [0x101f8004], eax
jmp 0x1001f11c
call esi
sub eax, dword [0x101f804c]
cmp byte [0x101f8099], 0
je 0x1001f12d
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f803c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001f12d
comiss xmm1, dword [0x101f8044]
ja 0x1001f12d
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8040]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001f12d
comiss xmm1, dword [0x101f8048]
ja 0x1001f12d
cmp dword [ebp + 8], 0x201
jne 0x1001f107
mov byte [0x101f8050], 1
mov al, 1
pop esi
pop ebp
ret 4
mov byte [0x101f8050], 0
cmp eax, 0x1f4
jb 0x1001f12d
call esi
mov dword [0x101f804c], eax
mov byte [0x101f8099], 0
mov dword [0xe8cb3c], 0
xor al, al
pop esi
pop ebp
ret 4

Function at 0x1001fa00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f804c]
cmp byte [0x101f8099], 0
je 0x1001faa5
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f803c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001faa5
comiss xmm1, dword [0x101f8044]
ja 0x1001faa5
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8040]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001faa5
comiss xmm1, dword [0x101f8048]
ja 0x1001faa5
cmp dword [ebp + 8], 0x201
jne 0x1001fa74
mov byte [0x101f8050], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f8050], 0
cmp eax, 0x1f4
jb 0x1001faa5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f804c], eax
mov byte [0x101f8099], 0
mov dword [0xe8cb3c], 0
mov byte [0x101f809b], 0
xor al, al
pop ebp
ret 4
Function at 0x10021900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x10021bf0
push 0x61fe3f
push 0xe8
call fcn.10063f10
push 0x10021c40
push 0x61feea
push 0xe8
call fcn.10063f10
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
add esp, 0x18
push eax
push 0x40
push 1
push 0x559b85
call esi
lea eax, [ebp - 4]
mov byte [0x559b85], 0xff
push eax
push dword [ebp - 4]
push 1
push 0x559b85
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b86
call esi
lea eax, [ebp - 4]
mov byte [0x559b86], 0xff
push eax
push dword [ebp - 4]
push 1
push 0x559b86
call esi
push 0x10021c90
push 0x4e199d
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x587049
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x590ccc
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x5bbee6
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x64229d
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x642d51
push 0xe8
call fcn.10063f10
add esp, 0x48
push 0x10021c90
push 0x643229
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x65ea86
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x911a53
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x911a6d
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x911a87
push 0xe8
call fcn.10063f10
push 0x10021c90
push 0x911aa1
push 0xe8
call fcn.10063f10
add esp, 0x48
push 0x10021c90
push 0x911abb
push 0xe8
call fcn.10063f10
push 0x10021db0
push 0x58101a
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x58105b
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x58109c
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x5810dd
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x58111e
push 0xff
call fcn.10063f10
add esp, 0x48
push 0x10021db0
push 0x58115f
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x5811a0
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x5811e1
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x581222
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x581263
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x5812a8
push 0xff
call fcn.10063f10
add esp, 0x48
push 0x10021db0
push 0x5812ed
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x58132e
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x58136f
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x5813b4
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x5813f9
push 0xff
call fcn.10063f10
push 0x10021db0
push 0x586859
push 0xff
call fcn.10063f10
add esp, 0x48
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10023280
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x10022800
mov byte [ebp - 0x10], 0xe9
sub eax, 0x4d7d18
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4d7d13
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100232e0
mov eax, dword [ebp - 0x10]
mov ecx, 0x4d7d13
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100232e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x100249f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub eax, dword [0x101f6594]
sub ecx, dword [0x101f654c]
cmp byte [0x101f64c1], 0
je 0x10024ac9
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f653c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10024ac9
comiss xmm1, dword [0x101f6544]
ja 0x10024ac9
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6540]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10024ac9
comiss xmm1, dword [0x101f6548]
ja 0x10024ac9
cmp dword [ebp + 8], 0x201
jne 0x10024a79
mov byte [0x101f6550], 1
mov al, 1
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x3e8
jb 0x10024ac9
cmp eax, 0x3e8
jb 0x10024ac9
call fcn.100240d0
mov byte [0x101f6550], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f654c], eax
lea ecx, [ebp - 8]
mov eax, dword [0x10202ba8]
mov edx, 5
inc eax
mov dword [ebp - 8], 0xe6f305c1
mov dword [0x10202ba8], eax
mov byte [ebp - 4], al
call fcn.1005d410
mov al, 1
mov esp, ebp
pop ebp
ret 4
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x10024ae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub eax, dword [0x101f6594]
sub ecx, dword [0x101f654c]
cmp byte [0x101f64c1], 0
je 0x10024bb9
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6584]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10024bb9
comiss xmm1, dword [0x101f658c]
ja 0x10024bb9
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6588]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10024bb9
comiss xmm1, dword [0x101f6590]
ja 0x10024bb9
cmp dword [ebp + 8], 0x201
jne 0x10024b69
mov byte [0x101f6598], 1
mov al, 1
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x3e8
jb 0x10024bb9
cmp eax, 0x3e8
jb 0x10024bb9
call fcn.100240d0
mov byte [0x101f6598], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6594], eax
lea ecx, [ebp - 8]
mov eax, dword [0x10202ba8]
mov edx, 5
dec eax
mov dword [ebp - 8], 0xe6f305c1
mov dword [0x10202ba8], eax
mov byte [ebp - 4], al
call fcn.1005d410
mov al, 1
mov esp, ebp
pop ebp
ret 4
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x10024bd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f693c]
cmp byte [0x101f64c1], 0
je 0x10024c6e
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f692c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10024c6e
comiss xmm1, dword [0x101f6934]
ja 0x10024c6e
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6930]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10024c6e
comiss xmm1, dword [0x101f6938]
ja 0x10024c6e
cmp dword [ebp + 8], 0x201
jne 0x10024c44
mov byte [0x101f6940], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6940], 0
cmp eax, 0x1f4
jb 0x10024c6e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f693c], eax
mov byte [0x101f64c1], 0
mov dword [0xe8cb3c], 0
xor al, al
pop ebp
ret 4

Function at 0x10024c80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f64bc]
cmp eax, 0x5dc
jb 0x10024d5d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x101f64c1], 1
mov dword [0x101f64bc], eax
jne 0x10024cc6
mov byte [0x101f64c1], 0
mov dword [0xe8cb3c], 0
mov esp, ebp
pop ebp
ret
mov byte [0x101f6b39], 0
mov dword [0xe8cb3c], 0
mov byte [0x101f65e1], 0
mov dword [0xe8cb3c], 0
mov byte [0x101f64c1], 0
mov byte [0x101f69d1], 0
mov byte [0x101f6e99], 0
mov dword [0xe8cb3c], 0
call fcn.100240d0
mov edx, 4
mov dword [0x10202bb0], 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xe7f304c1
call fcn.1005d410
mov edx, 5
mov dword [ebp - 8], 0xe6f305c1
lea ecx, [ebp - 8]
mov dword [0x10202ba8], 0
mov byte [ebp - 4], 0
call fcn.1005d410
mov byte [0x101f64c1], 1
mov dword [0xe8cb3c], 1
mov esp, ebp
pop ebp
ret