joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008c950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x188
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, dword [edi]
test ebx, ebx
je 0x1008cb75
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push 0x40
lea ecx, [esp + 0x68]
mov dword [esp + 0x1c], 0
mov eax, dword [eax + 4]
push ecx
mov ecx, ebx
call eax
test al, al
je 0x1008cb75
cmp dword [esp + 0x14], 0x40
jne 0x1008cb75
mov eax, 0x5a4d
cmp word [esp + 0x60], ax
jne 0x1008cb75
mov eax, dword [ebx]
xorps xmm0, xmm0
mov ecx, ebx
movlpd qword [esp + 0x18], xmm0
mov esi, dword [eax + 0x18]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0xa0]
push 0
cdq
push edx
push eax
call esi
test al, al
je 0x1008cb75
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push 0xf8
lea ecx, [esp + 0xa8]
mov eax, dword [eax + 4]
push ecx
mov ecx, ebx
call eax
test al, al
je 0x1008cb75
cmp dword [esp + 0x14], 0xf8
jne 0x1008cb75
cmp dword [esp + 0xa0], 0x4550
jne 0x1008cb75
mov eax, dword [ebx]
movzx ecx, word [esp + 0xa6]
dec ecx
mov edx, dword [eax + 0x18]
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [ecx + ecx*4]
mov ecx, ebx
shl eax, 3
push 0
push eax
call edx
test al, al
je 0x1008cb75
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push 0x28
lea ecx, [esp + 0x40]
mov eax, dword [eax + 4]
push ecx
mov ecx, ebx
call eax
test al, al
je 0x1008cb75
cmp dword [esp + 0x14], 0x28
jne 0x1008cb75
mov ecx, dword [esp + 0x48]
xor edx, edx
mov esi, dword [esp + 0xdc]
mov eax, ecx
div esi
test edx, edx
je 0x1008ca86
lea ecx, [eax + 1]
imul ecx, esi
mov eax, dword [esp + 0x4c]
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x13c]
mov dword [esp + 0x18], edx
test ecx, ecx
je 0x1008caae
mov eax, dword [esp + 0x138]
test eax, eax
je 0x1008caae
lea ebx, [ecx + eax]
cmp ebx, edx
jae 0x1008cab0
mov ebx, edx
cmp ebx, 0xffffffff
je 0x1008cb75
xor eax, eax
cmp edx, ebx
setne al
inc eax
xor esi, esi
mov dword [esp + 0x24], eax
mov ecx, dword [edi]
mov eax, edx
test esi, esi
lea edx, [esp + 0x28]
xorps xmm0, xmm0
cmovle eax, ebx
movlpd qword [esp + 0x28], xmm0
mov ebx, eax
mov eax, dword [ecx]
push edx
push 0
push 0
mov eax, dword [eax + 0x18]
push ebx
call eax
test al, al
je 0x1008cb31
mov ecx, dword [edi]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0
lea ebp, [edi + 0x10]
push edx
push 0x1c
mov eax, dword [ecx]
push ebp
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x1008cb18
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1008cb31
cmp dword [esp + 0x14], 0x1c
jne 0x1008cb31
cmp byte [ebp], 0x47
jne 0x1008cb31
cmp byte [edi + 0x11], 0x4d
jne 0x1008cb31
cmp byte [edi + 0x12], 0xee
je 0x1008cb3e
inc esi
cmp esi, dword [esp + 0x24]
jae 0x1008cb75
mov edx, dword [esp + 0x18]
jmp 0x1008cac7
mov ecx, dword [edi]
lea edx, [esp + 0x30]
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x1008cb75
cmp dword [edi + 0x28], 0x11223344
mov dword [edi + 0xc], ebx
jne 0x1008cb75
cmp dword [edi + 0x1c], 0
je 0x1008cb75
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10097290
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024bc68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
push 0x70
mov edi, ecx
call fcn.1006e6a7
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
lea ecx, [esi + 4]
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [esi], edx
call fcn.1001a380
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov byte [esi + 0x1c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 7
mov word [esi + 0x38], ax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], 7
mov word [esi + 0x50], ax
mov dword [esi + 0x68], eax
mov al, byte [ebp + 0x10]
mov byte [esi + 0x6c], al
mov eax, edi
mov dword [edi], esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10098810
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
test ecx, ecx
je 0x10098934
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10098934
mov edi, dword [esp + 0x14]
test edi, edi
jle 0x10098934
cmp edi, 3
jl 0x100988c5
mov eax, 0xaaaaaaab
mul edi
push ebx
mov ebx, edx
shr ebx, 1
lea eax, [ebx*4]
sub eax, ebx
neg eax
add edi, eax
nop dword [eax + eax]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x10256110]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + 0x10256110]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + 0x10256110]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + 0x10256110]
mov byte [ecx + 3], al
add ecx, 4
sub ebx, 1
jne 0x10098860
pop ebx
test edi, edi
jle 0x1009892a
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x10256110]
mov byte [ecx], al
mov dl, byte [esi]
and dl, 3
shl dl, 4
cmp edi, 1
jle 0x100988ec
mov al, byte [esi + 1]
shr al, 4
or dl, al
movzx eax, dl
mov al, byte [eax + 0x10256110]
mov byte [ecx + 1], al
cmp edi, 2
jge 0x10098912
mov al, 0x3d
mov byte [ecx + 2], al
mov byte [ecx + 3], al
add ecx, 4
pop edi
mov al, 1
pop esi
mov byte [ecx], 0
ret 0xc
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + 0x10256110]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
pop edi
mov byte [ecx], 0
mov al, 1
pop esi
ret 0xc
pop edi
xor al, al
pop esi
ret 0xc
Function at 0x1009a400
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024bdea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], vtable.WM::GMFile.0
mov dword [ebp - 0x14], 0xffffffff
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0x80
push 2
push 3
push 0x40000000
push esi
mov dword [ebp - 4], 0
call sym.WMCommon.dll_public:_bool___thiscall_WM::GMFile::Create_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___unsigned_int__unsigned_int__unsigned_int__unsigned_int_
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test al, al
jne 0x1009a45e
xor bl, bl
jmp 0x1009a51d
xor bl, bl
mov dword [ebp - 0x28], vtable.WM::GMBuffer_unsigned_char_.0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 8]
call sym.WMCommon.dll_private:_static_bool___cdecl_WM::GMImageEncrypt::EncryptFileToBuffer_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_WM::GMBuffer_unsigned_char____bool_
add esp, 0xc
test al, al
jne 0x1009a4a7
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1009a4ef
push eax
call fcn.1006e708
add esp, 4
jmp 0x1009a4ef
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x1009a4e9
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x1009a4e0
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1009a4e0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jne 0x1009a4e0
push edi
mov bl, 1
call fcn.1006e708
add esp, 4
jmp 0x1009a517
push edi
call fcn.1006e708
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x1009a508
push eax
call edi
mov ecx, dword [ebp - 0x14]
or edx, 0xffffffff
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
cmp dword [esi + 0x14], 8
jb 0x1009a510
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], vtable.WM::GMFile.0
cmp eax, 0xffffffff
je 0x1009a52f
push eax
call edi
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1009a550
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024be04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], vtable.WM::GMFile.0
mov dword [ebp - 0x14], 0xffffffff
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0x80
push 2
push 3
push 0x40000000
push esi
mov dword [ebp - 4], 0
call sym.WMCommon.dll_public:_bool___thiscall_WM::GMFile::Create_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___unsigned_int__unsigned_int__unsigned_int__unsigned_int_
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test al, al
jne 0x1009a5ae
xor bl, bl
jmp 0x1009a66d
xor bl, bl
mov dword [ebp - 0x28], vtable.WM::GMBuffer_unsigned_char_.0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 8]
call sym.WMCommon.dll_private:_static_bool___cdecl_WM::GMImageEncrypt::EncryptFileToBuffer_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_WM::GMBuffer_unsigned_char____bool_
add esp, 0xc
test al, al
jne 0x1009a5f7
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1009a63f
push eax
call fcn.1006e708
add esp, 4
jmp 0x1009a63f
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x1009a639
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x1009a630
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1009a630
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jne 0x1009a630
push edi
mov bl, 1
call fcn.1006e708
add esp, 4
jmp 0x1009a667
push edi
call fcn.1006e708
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x1009a658
push eax
call edi
mov ecx, dword [ebp - 0x14]
or edx, 0xffffffff
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
cmp dword [esi + 0x14], 8
jb 0x1009a660
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], vtable.WM::GMFile.0
cmp eax, 0xffffffff
je 0x1009a67f
push eax
call edi
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1009a9c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024be32
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
push 0x68
call fcn.1006e6a7
mov edi, eax
mov dword [ebp - 0x1c], edi
push 0x40
lea eax, [edi + 0x18]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push 0
push eax
movups xmmword [edi + 0x58], xmm0
call sub.VCRUNTIME140.dll_memset
mov dword [edi + 4], 0
add esp, 0x10
mov dword [edi], 0
mov dword [edi + 8], 0x67452301
mov dword [edi + 0xc], 0xefcdab89
mov dword [edi + 0x10], 0x98badcfe
mov dword [edi + 0x14], 0x10325476
mov dword [ebp - 0x24], vtable.WM::GMFile.0
mov dword [ebp - 0x20], 0xffffffff
push 0x80
push 3
push 1
push accept
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call sym.WMCommon.dll_public:_bool___thiscall_WM::GMFile::Create_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___unsigned_int__unsigned_int__unsigned_int__unsigned_int_
test al, al
je 0x1009ab41
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1009ab44
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009aa8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009ab41
mov eax, dword [ebp - 0x18]
xor ecx, ecx
add ecx, esi
adc eax, 0
or ecx, eax
je 0x1009ab41
push 0x10000
mov dword [ebp - 0x14], 0
call fcn.1006e70d
mov esi, eax
add esp, 4
test esi, esi
je 0x1009ab41
nop
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xffffffff
je 0x1009ab1b
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x10000
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009aafc
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1009aafc
push eax
mov edx, esi
mov ecx, edi
call fcn.1009d700
add esp, 4
jmp 0x1009aac0
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1009ab1b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x20]
test eax, eax
mov eax, 0xffffffff
cmovne ecx, eax
mov dword [ebp - 0x20], ecx
push esi
call fcn.1006e708
add esp, 4
lea edx, [edi + 0x58]
mov ecx, edi
call fcn.1009d570
mov eax, dword [ebp + 0xc]
movups xmm0, xmmword [edi + 0x58]
mov byte [ebp - 0xd], 1
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x20]
jmp 0x1009ab48
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x24], vtable.WM::GMFile.0
cmp eax, 0xffffffff
je 0x1009ab6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x20]
test eax, eax
mov eax, 0xffffffff
cmovne ecx, eax
mov dword [ebp - 0x20], ecx
push 0x68
push edi
mov dword [ebp - 0x24], vtable.WM::GMBaseFile.0
call fcn.1006e6d7
mov ecx, dword [ebp - 0xc]
add esp, 8
mov al, byte [ebp - 0xd]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1009acb0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x10
push ebx
test ecx, ecx
je 0x1009ae07
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
and eax, 0xfffffffc
cmp eax, 0x20
jne 0x1009ae07
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
and eax, 0xfffffffc
cmp eax, 0x100
jne 0x1009ae07
push ebp
push esi
push edi
push ecx
lea ecx, [esp + 0x18]
call fcn.10020000
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], 0
mov edx, dword [edi + 0x10]
mov ebp, edx
mov esi, dword [edi + 0x18]
mov eax, edx
rol eax, 7
mov ecx, edx
ror ebp, 0xb
not ecx
xor ebp, eax
and ecx, esi
mov eax, edx
ror eax, 6
xor ebp, eax
mov eax, dword [edi + 0x14]
and eax, edx
xor ecx, eax
mov eax, dword [ebx]
add ebp, ecx
mov ecx, dword [esp + 0x10]
add ebp, dword [eax + ecx]
mov eax, dword [sym.WMCommon.dll_class_std::vector_unsigned_int__class_std::allocator_unsigned_int___WM::Sha256::add_constant_]
add ebp, dword [ecx + eax]
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx]
add ebp, dword [ecx + 0x1c]
mov ebx, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov dword [ecx + 0x1c], esi
mov eax, dword [ecx + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [ecx + 0x10]
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0xc]
add eax, ebp
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 8]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [ecx + 8], eax
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, edi
ror ecx, 0xd
mov eax, edi
rol eax, 0xa
xor ecx, eax
mov eax, edi
ror eax, 2
xor ecx, eax
mov eax, ebx
xor eax, edi
and ebx, edi
mov edi, dword [esp + 0x14]
and eax, edx
xor eax, ebx
add ecx, ebp
mov ebx, dword [esp + 0x24]
add ecx, eax
mov eax, dword [esp + 0x10]
add eax, 4
mov dword [edi], ecx
mov dword [esp + 0x10], eax
cmp eax, 0x100
jl 0x1009ad01
mov edx, dword [esp + 0x28]
mov eax, dword [edx]
add dword [eax], ecx
mov ecx, dword [edx]
mov eax, dword [edi + 4]
add dword [ecx + 4], eax
mov ecx, dword [edx]
mov eax, dword [edi + 8]
add dword [ecx + 8], eax
mov ecx, dword [edx]
mov eax, dword [edi + 0xc]
add dword [ecx + 0xc], eax
mov ecx, dword [edx]
mov eax, dword [edi + 0x10]
add dword [ecx + 0x10], eax
mov ecx, dword [edx]
mov eax, dword [edi + 0x14]
add dword [ecx + 0x14], eax
mov ecx, dword [edx]
mov eax, dword [edi + 0x18]
add dword [ecx + 0x18], eax
mov ecx, dword [edx]
mov eax, dword [edi + 0x1c]
add dword [ecx + 0x1c], eax
lea ecx, [esp + 0x14]
call fcn.100202c0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 8
xor al, al
pop ebx
add esp, 0x10
ret 8
Function at 0x1009ae10
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
test ebp, ebp
je 0x1009aec3
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 4]
sub eax, dword [edi]
cmp eax, 0x40
jne 0x1009aec3
push ebx
push esi
push ebp
push ecx
mov ecx, ebp
call fcn.1002f810
xor esi, esi
nop dword [eax]
mov ecx, dword [edi]
add ecx, esi
movzx eax, byte [ecx]
movzx edx, byte [ecx + 1]
shl eax, 8
or edx, eax
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 3]
shl edx, 8
or edx, eax
mov eax, dword [ebp]
mov dword [esi + eax], edx
add esi, 4
cmp esi, 0x40
jl 0x1009ae40
mov ebx, 4
mov edi, dword [ebp]
mov ecx, dword [ebx + edi]
mov esi, ecx
mov edx, dword [ebx + edi + 0x34]
mov eax, ecx
rol esi, 0xe
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx + edi - 4]
add esi, dword [ebx + edi + 0x20]
mov dword [ebx + edi + 0x3c], esi
add ebx, 4
cmp ebx, 0xc4
jl 0x1009ae75
pop esi
pop ebx
pop edi
mov al, 1
pop ebp
ret 8
pop edi
xor al, al
pop ebp
ret 8

Function at 0x1009cc30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x10320d80], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x10320a80], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x10320c80], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x10320b80], al
inc esi
cmp esi, 0x100
jl 0x1009cd40
pop esi
add esp, 0x80
ret
Function at 0x100a0120
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x2690]
test ecx, ecx
je 0x100a0261
mov dword [esp + 0x10], 0x1e8480
lea edx, [esp + 0x10]
mov eax, dword [ecx]
push edx
call dword [eax + 0x24]
test eax, eax
jne 0x100a0261
mov esi, dword [esp + 0x10]
mov ecx, dword [edi + 0x2678]
shl esi, 0xa
test ecx, ecx
je 0x100a016a
mov eax, esi
xor edx, edx
div ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x1c]
mov ebp, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
sub ecx, dword [edi]
mov eax, dword [eax]
sbb ebx, dword [edi + 4]
mov dword [esp + 0x14], eax
cmp ebp, eax
je 0x100a0222
mov edx, ebx
call fcn.102476a0
sub ebp, dword [esp + 0x14]
movd xmm1, ebp
cvtdq2pd xmm1, xmm1
shr ebp, 0x1f
addsd xmm1, qword [ebp*8 + 0x10282cb0]
divsd xmm0, xmm1
mulsd xmm0, qword [0x102823d8]
call fcn.10247531
mov ebx, eax
cmp ebx, esi
jle 0x100a0261
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ecx
mov ecx, dword [esp + 0x28]
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 4], eax
mov eax, ebx
sub eax, esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm1
mulsd xmm0, qword [0x102823d8]
call fcn.10247531
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0x10
mov eax, esi
cdq
cmp ebx, edx
jl 0x100a0261
jg 0x100a022f
cmp ecx, eax
jbe 0x100a0261
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ecx
mov ecx, dword [esp + 0x28]
push 0x3e8
mov dword [ecx], eax
mov eax, dword [esp + 0x24]
mov dword [edi], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0x10
Function at 0x100a0920
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x100c
call fcn.1006fb30
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
push esi
lea esi, [esp + 0x14]
mov dword [esp + 0xc], ecx
push edi
sub esi, ebx
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [esi + edx - 2], ax
test ax, ax
jne 0x100a0942
push 0
push 0
lea eax, [esp + 0x20]
push eax
push sym.WMCommon.dll_private:_static_unsigned_int___cdecl_WM::GMHttpDownload::QueryLocationFunc_void__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
push 0x14d
push esi
call edi
cmp eax, 0x102
jne 0x100a09a3
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x2690]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jne 0x100a09f6
push 0x14d
push esi
call edi
cmp eax, 0x102
je 0x100a0981
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
cmp dword [esp + 0x14], eax
je 0x100a0a44
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a09d3
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, esi
call fcn.1001a600
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
mov ecx, ebx
xor eax, eax
mov dword [esi + 0x10], 0
lea edx, [ecx + 2]
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a0a21
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, esi
call fcn.1001a600
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x818]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a0a50
sub ecx, edx
lea eax, [esp + 0x818]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001a600
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8