joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100411a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x160]
mov edi, eax
test edi, edi
js 0x1004130d
test ebx, ebx
je 0x1004130d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x100411f2
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x188]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004124e
mov eax, dword [esi + 0x18c]
cmp eax, dword [esi + 0x18c]
je 0x10041272
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x10141a98
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100412f6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10041280
push 0x10
call fcn.100d4efc
mov esi, eax
add esp, 4
test esi, esi
je 0x100411e0
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexDeclaration9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexDeclaration9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10041306
lea eax, [ebp + 8]
add ecx, 0x188
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x10141a98
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10041320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x174]
mov edi, eax
test edi, edi
js 0x1004148d
test ebx, ebx
je 0x1004148d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10041372
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1a8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x100413ce
mov eax, dword [esi + 0x1ac]
cmp eax, dword [esi + 0x1ac]
je 0x100413f2
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x10141a98
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10041476
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10041400
push 0x10
call fcn.100d4efc
mov esi, eax
add esp, 4
test esi, esi
je 0x10041360
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexShader9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10041486
lea eax, [ebp + 8]
add ecx, 0x1a8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x10141a98
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100437b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10120289
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1015fc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x100437fa
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1c8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x10043859
mov eax, dword [esi + 0x1cc]
cmp eax, dword [esi + 0x1cc]
je 0x10043881
mov eax, dword [eax + 0xc]
lea ecx, [eax - 4]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, 0x10141a98
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10043907
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10043890
push 0x10
call fcn.100d4efc
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1004396f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DVolume9.0
lea eax, [ebp - 0x1c]
mov dword [esi], vtable.m_IDirect3DVolume9.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x1c8
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
call fcn.1003dfb0
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x10043971
push 0x14
call fcn.100d4efc
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x1004396f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DSwapChain9Ex.0
lea eax, [ebp - 0x14]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x128
mov byte [ebp - 4], 3
mov dword [ebp + 8], ebx
call fcn.1003dfb0
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x10043971
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10043ae0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.1003df40
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x10043b39
mov ecx, dword [edi + 4]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10058b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10058b71
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10058b60
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10065050
Capabilities:
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
mov ecx, dword [eax + 0x10]
jbe 0x1006507a
mov eax, dword [eax]
push esi
push 0
push ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x10065097
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
push 0x6801
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x100650b7
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10067c00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10122bcd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1015fc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100d4efc
mov edi, eax
add esp, 4
test edi, edi
je 0x10067c9d
push 1
mov dword [ebp - 4], 0
call fcn.100d7598
add esp, 4
mov dword [edi + 4], eax
jmp 0x10067c9f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10045260
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x10067cfa
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10067cfa
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10067d16
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10067d39
cmp byte [ebp + 0xc], 0
je 0x10067d25
push esi
call fcn.100d7a5e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10067d45
mov esi, str.ios_base::badbit_set
jmp 0x10067d55
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10046c00
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10045a10
push 0x10156418
lea eax, [ebp - 0x28]
push eax
call fcn.100f1f9e
int3
Function at 0x1006ca30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1015fc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x35c], 0
mov dword [eax + 0x258], 1
mov dword [eax + 0x26c], 0
mov dword [eax + 0x270], 0
mov dword [eax + 0x274], 0
mov dword [eax + 0x278], 0x3f800000
jne 0x1006ca88
mov dword [eax + 0x35c], 1
cmp dword [eax + 0x3c], 0x1f
lea ecx, [eax + 0x28]
lea eax, [ebp - 0x2c]
jb 0x1006cae5
push dword [ecx]
push eax
call fcn.10079fa0
mov ecx, dword [ebp - 0x18]
add esp, 8
cmp ecx, 0xf
jbe 0x1006cb90
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006cacd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006cb9e
push ecx
push edx
call fcn.100d4f2c
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d4eee
mov esp, ebp
pop ebp
ret
push ecx
push eax
call fcn.10079fa0
add esp, 8
mov dword [ebp - 0x14], 0x64684d09
mov cl, 9
mov dword [ebp - 0x10], 0x566c6e68
mov dword [ebp - 0xc], 0x6c6b6845
xor eax, eax
mov word [ebp - 8], 0x65
nop
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x1006cb1f
mov cl, byte [ebp - 0x14]
jmp 0x1006cb10
lea ecx, [ebp - 0x13]
mov byte [ebp - 7], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006cb30
push esi
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x2c]
push edi
mov edi, dword [ebp - 0x18]
sub ecx, edx
push ecx
lea ecx, [ebp - 0x13]
cmp edi, 0xf
push ecx
push dword [ebp - 0x1c]
cmova eax, esi
push eax
call fcn.10045080
add esp, 0x10
test al, al
jne 0x1006cb62
mov byte [ebp - 5], al
cmp edi, 0xf
jbe 0x1006cb8e
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1006cb84
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006cba3
push ecx
push esi
call fcn.100d4f2c
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d4eee
mov esp, ebp
pop ebp
ret
call fcn.10100cd5
call fcn.10100cd5
int3
Function at 0x10074740
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x10199478
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [0x10199478]
mov ebx, esi
sub ebx, dword [0x10199470]
mov eax, dword [0x1019947c]
mov edi, eax
sbb edi, dword [0x10199474]
mov edx, dword [0x1019948c]
mov ecx, dword [0x10199488]
mov dword [0x10199480], ebx
mov dword [0x10199484], edi
mov dword [0x10199470], esi
mov dword [0x10199474], eax
call fcn.100d53d0
mov edx, edi
movss dword [ebp - 4], xmm0
mov ecx, ebx
call fcn.100d53d0
cmp byte [0x10198e01], 0
movss xmm2, dword [ebp - 4]
divss xmm2, xmm0
movss dword [0x1019946c], xmm2
je 0x1007480e
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 8]
push eax
call edi
movsd xmm0, qword [0x101994b8]
call fcn.100d5200
mov edx, dword [ebp - 4]
mov esi, eax
mov ecx, dword [ebp - 8]
call fcn.100d5300
divsd xmm0, qword [0x101994b0]
movsd qword [0x101994b8], xmm0
call fcn.100d5200
mov ecx, eax
sub ecx, esi
cmp esi, eax
sbb eax, eax
test ecx, eax
je 0x100747c5
movss xmm2, dword [0x1019946c]
cmp dword [0x10198ed4], 5
pop edi
pop esi
pop ebx
jl 0x10074880
movss xmm1, dword [0x101994ac]
movsd xmm0, qword [0x10131e70]
cvtps2pd xmm1, xmm1
comisd xmm0, xmm1
movss xmm0, dword [0x1012a2f0]
divss xmm0, xmm2
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x10131e68]
cvtpd2ps xmm0, xmm0
jbe 0x10074858
mulss xmm0, dword [0x1012a4e4]
jmp 0x10074860
mulss xmm0, dword [0x1012e620]
movss dword [str.B_e_], xmm0
movss dword [0x10199490], xmm0
movss dword [0x10199494], xmm0
movss dword [0x10199498], xmm0
mov esp, ebp
pop ebp
ret
Function at 0x10075620
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1015fc40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov byte [ebp - 0x114], 0x46
mov al, 0x69
xor al, byte [ebp - 0x114]
mov cl, 0x32
xor cl, byte [ebp - 0x114]
mov bl, 0x23
mov byte [ebp - 0x113], al
mov ch, bl
mov byte [ebp - 0x112], cl
mov ah, 0x2b
mov cl, byte [ebp - 0x114]
mov dl, 0x2e
mov byte [ebp - 0x11d], 0x34
xor ah, cl
mov al, byte [ebp - 0x11d]
mov dh, 0x35
xor al, cl
mov byte [ebp - 0x11e], ch
mov byte [ebp - 0x10b], al
mov bh, 0x68
mov al, byte [ebp - 0x11e]
xor dl, cl
xor al, cl
mov byte [ebp - 0x10f], ah
mov byte [ebp - 0x10a], al
xor bl, cl
lea eax, [ebp - 0x113]
mov byte [ebp - 0x109], 0
push eax
lea eax, [ebp - 0x108]
mov byte [ebp - 0x111], dl
xor ch, cl
mov byte [ebp - 0x110], bl
xor dh, cl
mov byte [ebp - 0x10e], ch
xor bh, cl
mov byte [ebp - 0x10d], dh
push 0x104
push eax
mov byte [ebp - 0x10c], bh
mov byte [ebp - 0x109], 0
call fcn.10103760
mov ch, 0x47
mov byte [ebp - 0x116], 0
mov dl, 0x22
mov byte [ebp - 0x11c], ch
mov ah, dl
mov byte [ebp - 0x116], 0
mov al, 0x13
mov byte [ebp - 0x109], 0
xor al, ch
mov cl, 0x2f
xor cl, ch
mov byte [ebp - 0x11b], al
xor dl, ch
mov byte [ebp - 0x11a], cl
xor ah, ch
mov byte [ebp - 0x119], dl
mov dh, 0x70
mov byte [ebp - 0x117], ah
mov bl, 0x2a
mov byte [ebp - 0x110], dh
xor bl, ch
mov al, 0x24
mov cl, 0x18
mov byte [ebp - 0x118], bl
mov dl, 0x15
xor al, dh
xor cl, dh
mov byte [ebp - 0x10f], al
add esp, 0xc
mov byte [ebp - 0x10e], cl
mov ah, dl
mov bl, 0x1d
mov ch, 3
xor dl, dh
xor ah, dh
mov byte [ebp - 0x10d], dl
mov byte [ebp - 0x10b], ah
xor bl, dh
lea eax, [ebp - 0x108]
mov byte [ebp - 0x10c], bl
push eax
push 0
lea eax, [ebp - 0x11b]
mov byte [ebp - 0x109], 0
push eax
lea eax, [ebp - 0x10f]
xor ch, dh
push eax
mov byte [ebp - 0x10a], ch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x1015f668], eax
mov cl, 0x70
mov al, 0x9b
mov byte [ebp - 0x122], 0
xor al, cl
mov byte [ebp - 0x124], cl
mov byte [ebp - 0x123], al
lea eax, [ebp - 0x123]
push 1
push eax
push dword [0x10199540]
mov byte [ebp - 0x122], 0
call fcn.1007a0e0
push 6
push 0x10075580
push dword [0x10199534]
call fcn.10079da0
push 7
push 0x100755d0
push dword [0x10199554]
call fcn.10079da0
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop ebx
call fcn.100d4eee
mov esp, ebp
pop ebp
ret
Function at 0x10079da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp esi, 5
jl 0x10079e73
push 0x40
push 0x3000
lea eax, [esi + 5]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x10079dd8
push str.Failed_to_allocate_memory_for_trampoline.
jmp 0x10079e78
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10079e01
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push str.Failed_to_change_memory_protection.
jmp 0x10079e78
push esi
push ebx
push edi
call fcn.100f13f0
mov eax, ebx
mov byte [edi + esi], 0xe9
sub eax, edi
add esp, 0xc
sub eax, 5
mov dword [edi + esi + 1], eax
mov eax, dword [ebp + 0xc]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
cmp esi, 5
jle 0x10079e43
lea eax, [esi - 5]
push eax
lea eax, [ebx + 5]
push 0x90
push eax
call fcn.100f1970
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10079e6a
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push str.Failed_to_restore_memory_protection.
jmp 0x10079e78
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Length_must_be_at_least_5_bytes_to_apply_a_hook.
lea ecx, [ebp - 0xc]
call fcn.1004d0e0
push 0x10156cb4
lea eax, [ebp - 0xc]
push eax
call fcn.100f1f9e
int3

Function at 0x1007a0e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call fcn.100f13f0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007c250
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
push 0x1012e5ac
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x1007c283
push 0x1012e5ac
call esi
mov edi, eax
test edi, edi
jne 0x1007c283
push 0x101321e0
jmp 0x1007c304
push str.sfc.dll
call ebx
mov ebx, eax
test ebx, ebx
jne 0x1007c299
push str.sfc.dll
call esi
mov ebx, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push edi
call esi
push str.NtDuplicateObject
push edi
mov dword [0x101999d4], eax
call esi
push str.NtQueryObject
push edi
mov dword [0x101999d8], eax
call esi
push str.SfcIsFileProtected
push ebx
mov dword [0x101999dc], eax
call esi
push str.RtlGetFullPathName_U
push edi
mov dword [0x101999e0], eax
call esi
cmp dword [0x101999d4], 0
mov dword [0x101999e4], eax
je 0x1007c2ff
cmp dword [0x101999d8], 0
je 0x1007c2ff
cmp dword [0x101999dc], 0
je 0x1007c2ff
test eax, eax
jne 0x1007c317
push str.Failed_to_get_function_addresses_from_ntdll.dll
push 0x1019a348
call fcn.10076340
push eax
call fcn.100765e0
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x1007c980
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Contain obfuscated stackstrings
Convert ip address from string
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1015fc40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x190
call fcn.100d4efc
add esp, 4
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1007ca52
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1007ca52
mov eax, 2
push 0x6e05
mov word [ebp - 0x24], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
mov cl, 0x76
mov dword [ebp - 0x14], 0x47424776
xor eax, eax
mov dword [ebp - 0x10], 0x58434f58
mov dword [ebp - 0xc], 0x44584441
mov word [ebp - 8], 0x44
nop dword [eax]
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x1007ca0f
mov cl, byte [ebp - 0x14]
jmp 0x1007ca00
lea eax, [ebp - 0x20]
mov byte [ebp - 7], 0
push eax
lea eax, [ebp - 0x13]
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1007ca52
push 0x10
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
push esi
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
pop esi
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d4eee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.100d4eee
mov esp, ebp
pop ebp
ret