joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100059a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100867e0
push 0x10048df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
call fcn.10007470
test eax, eax
je 0x100059db
mov ecx, esi
call fcn.100056a0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10005a00
mov ecx, dword [0x100afb60]
mov ecx, dword [ecx]
mov eax, dword ds:[ecx]
push dword [ebp + 8]
notrack call dword ds:[eax + 0x80]
jmp 0x10005a3d
mov ax, word [0x100afbe0]
mov word [ebp - 0x30], ax
mov dword [ebp - 0x2e], 0xb
mov word [ebp - 0x2a], 0x1a
mov dword [ebp - 0x28], 0xffffffff
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov word [ebp - 0x20], 0xff
push 0
push 0x11
lea edx, [ebp - 0x30]
push edx
mov eax, dword [0x100ad830]
push eax
call fcn.10011400
mov dword [ebp - 4], 0xffffffff
push 0x7d0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
mov ecx, esi
call fcn.10004f40
test eax, eax
je 0x10005ae2
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
push 0x96
call ebx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10005a84
mov ecx, dword [ebp - 0x1c]
call fcn.10004f40
test eax, eax
je 0x10005ae2
mov ecx, dword [ebp - 0x1c]
call fcn.10005c00
cmp eax, 1
je 0x10005aaf
call esi
sub eax, edi
cmp eax, 0x2328
jbe 0x10005a6a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], 1
mov ecx, dword [0x100afb3c]
mov ecx, dword [ecx]
mov eax, dword ds:[ecx]
notrack call dword ds:[eax + 0x1ac]
jmp 0x10005adb
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10005b00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100867f8
push 0x10048df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
call fcn.10007470
test eax, eax
je 0x10005b38
mov ecx, ebx
call fcn.100056a0
mov dword [ebp - 4], 0
mov ecx, dword [0x100afb60]
mov ecx, dword [ecx]
mov eax, dword ds:[ecx]
push dword [ebp + 8]
notrack call dword ds:[eax + 0x80]
mov dword [ebp - 4], 0xffffffff
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.10004f40
test eax, eax
je 0x10005be3
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.10005c00
cmp eax, 1
je 0x10005bb0
call esi
sub eax, edi
cmp eax, 0x2328
jbe 0x10005b7b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 1
mov ecx, dword [0x100afb3c]
mov ecx, dword [ecx]
mov eax, dword ds:[ecx]
notrack call dword ds:[eax + 0x1ac]
jmp 0x10005bdc
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10005f00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086830
push 0x10048df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov ax, word [0x100afbe0]
mov word [ebp - 0x30], ax
mov dword [ebp - 0x2e], 0xb
mov word [ebp - 0x2a], 0x1a
or edi, 0xffffffff
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov word [ebp - 0x20], 0xff
push 0
push 0x11
lea edx, [ebp - 0x30]
push edx
mov eax, dword [0x100ad830]
push eax
call fcn.10011400
mov dword [ebp - 4], edi
push 0x7d0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
mov ecx, esi
call fcn.10004f40
test eax, eax
je 0x100060f8
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
push 0x64
call ebx
mov ecx, dword [ebp - 0x1c]
call fcn.10005c00
cmp eax, 1
je 0x10005fc9
call esi
sub eax, edi
cmp eax, 0x2af8
jbe 0x10005f9a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], 1
mov byte [ebp - 0xe4], 0
mov ecx, 0x2c
xor eax, eax
lea edi, [ebp - 0xe3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [0x100afb3c]
mov edx, dword [ecx]
mov edi, dword [edx + 0x3400]
mov dword [ebp - 0xe8], edi
xor ecx, ecx
mov dword [ebp - 0xec], ecx
mov esi, dword [0x100afba4]
cmp ecx, 0xa
jge 0x10006064
mov eax, dword [edi + ecx*4]
mov dword [ebp - 0xf0], eax
test eax, eax
je 0x10006064
mov edx, dword [eax + 0x14]
mov dword [ebp - 0xf4], edx
lea eax, [ecx + ecx*8]
add eax, eax
mov word [ebp + eax - 0xe4], si
mov dword [ebp + eax - 0xe2], 0xc
mov ebx, dword [ebp + 8]
mov dword [ebp + eax - 0xde], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + eax - 0xda], ebx
mov edx, dword [edx]
mov dword [ebp + eax - 0xd6], edx
inc ecx
mov dword [ebp - 0xec], ecx
jmp 0x1000600b
lea eax, [ecx + ecx*8]
add eax, eax
mov cx, word [0x100afb84]
mov word [ebp + eax - 0xe4], cx
mov dword [ebp + eax - 0xe2], 0x10
mov edx, dword [0x100afc90]
mov dword [ebp + eax - 0xde], edx
mov ecx, dword [0x100afc94]
mov dword [ebp + eax - 0xda], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp + eax - 0xd6], edx
or esi, 0xffffffff
mov dword [ebp + eax - 0xd2], esi
push 0
add eax, 0x16
push eax
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [0x100ad830]
push ecx
call fcn.10011400
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100106d0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
call fcn.1000ab20
mov ecx, esi
pop esi
jmp fcn.1000ef00
Function at 0x10011800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
sub esp, 0x24
cmp ecx, eax
jne 0x1001181e
push 0x10096adc
call fcn.1001bc90
add esp, 4
add esp, 0x24
ret
cmp ecx, 4
jne 0x10011834
push 0x10096ad0
call fcn.1001bc90
add esp, 4
add esp, 0x24
ret
mov dl, 0x65
mov byte [esp + 0x1e], cl
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0xf], dl
mov byte [esp + 0x13], dl
mov dx, word [0x100afb88]
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 9], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
mov word [esp], dx
mov edx, dword [ecx + 0x10]
mov ecx, dword [0x100ad830]
push eax
lea eax, [esp + 4]
push 0x22
push eax
push ecx
mov byte [esp + 0x12], 0x1c
mov byte [esp + 0x16], 0xf8
mov byte [esp + 0x17], 0x38
mov byte [esp + 0x18], 0xc
mov byte [esp + 0x1a], 0xe
mov byte [esp + 0x1b], 0x41
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x77
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x51
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x24], 0x73
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x69
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 2
mov dword [esp + 0x2a], edx
call fcn.10011400
add esp, 0x24
ret
Function at 0x1001af50
Capabilities:
Enumerate gui resources
Extract resource via kernel32 functions
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1001ac60
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 4], 0
push 0x10087874
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
mov esi, eax
mov dword [ebp - 0x14], esi
push 0x1009751c
push 0x3fa
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1001b053
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1001b053
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x24]
call fcn.100083f0
mov ebx, 1
mov byte [ebp - 4], bl
push esi
push 0x10096f74
lea eax, [ebp - 0x24]
push eax
call fcn.100766d3
add esp, 8
mov ecx, esp
mov dword [ebp - 0x28], esp
lea edx, [ebp - 0x24]
push edx
call fcn.1007b641
mov byte [ebp - 4], bl
lea eax, [ebp - 0x2c]
push eax
call fcn.1001ae90
add esp, 8
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x24]
call fcn.1007b9b9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c]
call fcn.1007b8cc
push 0
lea ecx, [ebp - 0x24]
call fcn.1007bc3c
push eax
call fcn.1001ae00
add esp, 4
test eax, eax
jne 0x1001b06d
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x24]
call fcn.1007b8cc
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.LuaPlus.dll
call edi
mov esi, eax
mov dword [ebp - 0x34], esi
push str.lua_dostring
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [0x100ad89c], eax
push str.lua_dofile
push esi
call edi
mov dword [0x100ad898], eax
push str.lua_pushcclosure
push esi
call edi
mov dword [0x100ad894], eax
push str.lua_pushstring
push esi
call edi
mov dword [0x100ad890], eax
push str.lua_settable
push esi
call edi
mov dword [0x100ad88c], eax
push str.lua_insert
push esi
call edi
mov dword [0x100ad888], eax
push str.lua_gettop
push esi
call edi
mov dword [0x100ad884], eax
push str.lua_newthread
push esi
call edi
mov dword [0x100ad880], eax
push str.lua_pushnumber
push esi
call edi
mov dword [0x100ad87c], eax
push str.lua_tonumber
push esi
call edi
mov dword [0x100ad878], eax
push str.lua_tostring
push esi
call edi
mov dword [0x100ad874], eax
push str.lua_gettable
push esi
call edi
mov dword [0x100ad870], eax
push str.lua_pushvalue
push esi
call edi
mov dword [0x100ad86c], eax
push str.lua_pcall
push esi
call edi
mov dword [0x100ad868], eax
push str.lua_settop
push esi
call edi
mov dword [0x100ad864], eax
mov eax, dword [0x100afb38]
mov dword [0x100ad860], eax
mov eax, dword [eax]
mov dword [0x100ad860], eax
mov ecx, dword [eax]
mov dword [0x100ad860], ecx
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.1007b8cc
mov eax, ebx
jmp 0x1001b055
Function at 0x10020910
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
push 0x100afc50
call fcn.1002b740
push 0x100afc54
call fcn.1002b740
push 0x100afc58
call fcn.1002b740
push 0x100afc68
call fcn.1002b740
push 0x100afc74
call fcn.1002b740
push 0x100afc6c
call fcn.1002b740
push 0x100afc70
call fcn.1002b740
push 0x100afc78
call fcn.1002b740
push 0x100afc80
call fcn.1002b740
push 0x100afc7c
call fcn.1002b740
push 0x100afc5c
call fcn.1002b740
push 0x100afc84
call fcn.1002b740
push 0x100afc88
call fcn.1002b740
push 0x100afc8c
call fcn.1002b740
mov eax, dword [0x100afd60]
xor edi, edi
add esp, 0x38
mov dword [eax + 0x5c], edi
mov ecx, dword [0x100afd4c]
call fcn.1000ab20
mov eax, dword [0x100afa40]
mov dword [0x100afdcc], edi
mov dword [0x100afdd4], edi
mov dword [0x100afdd8], edi
mov dword [0x100afdd0], edi
mov esi, dword [eax]
cmp esi, eax
je 0x100209f3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push edi
push ecx
call ebx
mov esi, dword [esi]
mov eax, dword [0x100afa40]
cmp esi, eax
jne 0x100209e0
pop ebx
pop edi
pop esi
ret

Function at 0x10021470
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, 0x100afa38
jmp fcn.100056a0

Function at 0x10026540
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100836c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x1009bc90
lea ecx, [ebp - 0x14]
call fcn.1007b93a
xor esi, esi
mov dword [ebp - 4], esi
mov byte [ebp - 4], 1
mov eax, dword [0x100afb30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
mov eax, dword [edx + 0x1ec]
mov eax, dword [eax + 4]
add eax, 0x34
mov dword [ebp - 0x18], eax
push eax
lea ecx, [ebp - 0x14]
call fcn.1007bbe8
push 0x100966a8
lea ecx, [ebp - 0x14]
call fcn.1007bbe8
mov dword [ebp - 4], esi
push esi
lea ecx, [ebp - 0x14]
call fcn.1007bc3c
push eax
push esi
mov ecx, dword [ebp + 8]
push ecx
push 0x100972a0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1007b8cc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100267d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10083708
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [esp + 0x20]
push esi
xor esi, esi
mov byte [esp + 4], al
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], esi
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
push ecx
push edx
call fcn.10029430
add esp, 4
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.10029430
add esp, 4
push eax
call fcn.10029540
add esp, 0xc
test eax, eax
jne 0x10026855
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esp + 8]
push ecx
call fcn.10077adb
add esp, 4
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebp, ebp
mov ecx, dword [esp + 0x14]
cmp ecx, esi
jne 0x1002686c
xor eax, eax
jmp 0x10026875
mov eax, dword [esp + 0x18]
sub eax, ecx
sar eax, 2
dec eax
cmp ebp, eax
jae 0x100269ae
mov edx, dword [ecx + ebp*4 + 4]
push edx
call fcn.100294d0
mov ebx, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + ebp*4]
push ecx
call fcn.100294a0
push ebx
mov esi, eax
call fcn.1001b230
add esp, 0xc
push 0x3e8
call edi
call fcn.10021bd0
test eax, eax
je 0x100268a2
call fcn.100267c0
mov ecx, dword [esp + 0x14]
cmp eax, dword [ecx + ebp*4]
jne 0x10026995
push 0x1f4
call edi
push esi
call fcn.10021bc0
add esp, 4
test eax, eax
je 0x100268a2
mov edx, dword [0x100afd9c]
push edx
call fcn.10028480
add esp, 4
test eax, eax
jne 0x1002698b
mov eax, dword [0x100afda0]
push eax
call fcn.10028480
add esp, 4
test eax, eax
jne 0x1002698b
push ebx
call fcn.1001b230
add esp, 4
push 0x3e8
call edi
push esi
call fcn.10021bc0
add esp, 4
test eax, eax
je 0x100268a2
call fcn.10048fc5
cdq
mov ecx, 0xa
idiv ecx
mov ecx, 0x100afa38
sub edx, 5
mov dword [esp + 0x30], edx
fild dword [esp + 0x30]
fstp dword [esp + 0x30]
call fcn.10005120
fadd dword [esp + 0x30]
push ecx
fstp dword [esp]
call fcn.10048fc5
cdq
mov ecx, 0xa
idiv ecx
mov ecx, 0x100afa38
sub edx, 5
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fstp dword [esp + 0x34]
call fcn.10005090
fadd dword [esp + 0x34]
push ecx
fstp dword [esp]
call fcn.1001b1c0
add esp, 8
jmp 0x100268a2
call fcn.1001b370
jmp 0x100268a2
cmp eax, dword [ecx + ebp*4 + 4]
jne 0x100268a2
push 0x3e8
call edi
inc ebp
xor esi, esi
jmp 0x10026860
mov dword [esp + 0x28], 0xffffffff
mov edx, dword [esp + 0x14]
push edx
call fcn.10077adb
mov ecx, dword [esp + 0x24]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x1c
ret
Function at 0x100281c0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100281df
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10028229
xor eax, eax
add esp, 0x14
ret
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x10029c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0xb8
cmp ecx, 0xf6
mov eax, edx
push esi
mov esi, ecx
jne 0x10029c70
mov esi, 3
cmp edx, 0xf6
jne 0x10029c7d
mov eax, 3
cmp ecx, 0x244
jne 0x10029c8a
mov esi, 4
cmp edx, 0x244
jne 0x10029c97
mov eax, 4
mov ecx, 0x3ea
mov edx, 0x3f7
push ebx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x80], edx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x98], ecx
mov dword [esp + 0xa8], edx
push ebp
lea ecx, [esi + eax*4]
mov edx, eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
xor ebx, ebx
mov ebp, 0x3f3
mov edi, 0x3ee
add edx, ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], 0x3e9
mov dword [esp + 0x70], ebp
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x84], 0x3ef
mov dword [esp + 0x8c], edi
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebp
mov dword [esp + 0x9c], 0x3f6
mov dword [esp + 0xa4], 0x3eb
mov dword [esp + 0xa8], 0x3ed
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb4], 3
mov dword [esp + 0xb8], 4
mov dword [esp + 0xbc], 6
mov dword [esp + 0xc0], 7
mov dword [esp + 0xc4], ebx
mov ecx, dword [esp + edx*4 + 0x64]
mov dword [esp + 0x18], 0x1009bfa4
mov dword [esp + 0x1c], 0x1009bf9c
mov dword [esp + 0x20], 0x1009bf94
mov dword [esp + 0x24], 0x1009bf88
mov dword [esp + 0x28], 0x1009bf80
mov edx, dword [esp + eax*4 + 0x18]
mov dword [esp + 0x3c], 0xb8
mov dword [esp + 0x40], 0x19
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 5
mov edi, dword [esp + eax*4 + 0x3c]
mov dword [esp + 0x50], 0x80
mov dword [esp + 0x54], 0x404
mov dword [esp + 0x58], 0x7ea
mov dword [esp + 0x5c], 0x44c
mov dword [esp + 0x60], 0x7b4f1
mov ebp, dword [esp + eax*4 + 0x50]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
push eax
call fcn.10021540
add esp, 4
push 0x3e8
call esi
mov dx, word [0x100afb84]
mov cx, word [0x100afb80]
or eax, 0xffffffff
mov word [esp + 0x26], dx
mov dword [esp + 0x22], eax
mov dword [esp + 0x38], eax
mov eax, dword [0x100ad830]
push ebx
lea edx, [esp + 0x1c]
mov word [esp + 0x1c], cx
mov ecx, dword [esp + 0x14]
push 0x24
push edx
push eax
mov dword [esp + 0x2a], 8
mov dword [esp + 0x2e], edi
mov dword [esp + 0x38], 0x10
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edi
call fcn.10011400
push 0x5dc
call esi
mov ecx, dword [0x100afd9c]
push ecx
call fcn.10028480
add esp, 4
test eax, eax
jne 0x10029e9b
mov edx, dword [0x100afda0]
push edx
call fcn.10028480
add esp, 4
test eax, eax
je 0x10029ea0
call fcn.1001b370
push 0x7d0
call esi
mov eax, dword [esp + 0xcc]
push eax
call fcn.10021bb0
add esp, 4
test eax, eax
jne 0x10029e00
pop edi
pop ebp
pop ebx
push 0x3e8
call esi
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.100294a0
push eax
call fcn.10021bc0
add esp, 8
test eax, eax
je 0x10029ec2
push 0x3e8
call esi
pop esi
add esp, 0xb8
ret
Function at 0x1002a660
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x1008386f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], 1
mov eax, dword [0x1009dd3c]
mov dword [esp + 0xc], eax
mov byte [esp + 0x20], 2
mov ecx, dword [0x1009dd3c]
mov dword [esp + 0x10], ecx
mov byte [esp + 0x20], 3
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x10]
call fcn.1007b9b9
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], esi
jle 0x1002a705
mov ebx, dword [esp + 0x30]
mov al, byte [esi + eax]
xor ecx, ecx
mov cl, bh
xor cl, al
push ecx
push esi
lea ecx, [esp + 0x14]
call fcn.1007bd0e
mov edx, dword [esp + 0xc]
movzx ax, byte [esi + edx]
add eax, ebx
mov ebx, 0x58bf
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea edx, [eax + ecx*2]
mov eax, dword [esp + 0x2c]
sub ebx, edx
inc esi
cmp esi, dword [eax - 8]
jl 0x1002a6c1
lea eax, [esp + 0xc]
lea ecx, [esp + 0x2c]
push eax
call fcn.1007b9b9
lea ecx, [esp + 0xc]
call fcn.1007b857
mov eax, dword [esp + 0x2c]
xor edi, edi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x1002a789
mov cl, byte [edi + eax]
push 0x1009bfac
mov byte [esp + 0x34], cl
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x34]
and esi, 0xff
call fcn.1007ba09
mov eax, esi
mov ecx, 0x1a
cdq
idiv ecx
lea ecx, [esp + 0x10]
add al, 0x41
mov ebx, edx
push eax
push 0
call fcn.1007bd0e
add bl, 0x41
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.1007bd0e
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
call fcn.1007bc24
mov eax, dword [esp + 0x2c]
inc edi
cmp edi, dword [eax - 8]
jl 0x1002a729
mov esi, dword [esp + 0x28]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.1007b641
mov dword [esp + 0x14], 1
mov byte [esp + 0x20], 2
lea ecx, [esp + 0x10]
call fcn.1007b8cc
mov byte [esp + 0x20], 1
lea ecx, [esp + 0xc]
call fcn.1007b8cc
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x2c]
call fcn.1007b8cc
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x1002a7e0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x100838af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 1
mov eax, dword [0x1009dd3c]
mov dword [esp + 4], eax
mov byte [esp + 0x20], 2
mov ecx, dword [0x1009dd3c]
mov dword [esp + 8], ecx
mov byte [esp + 0x20], 3
lea ecx, [esp + 4]
call fcn.1007b857
mov ecx, dword [esp + 0x2c]
xor esi, esi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x1002a8aa
push edi
mov dl, byte [ecx + esi*2]
mov al, byte [ecx + esi*2 + 1]
mov byte [esp + 0x10], dl
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x10]
push 0x1009bfb0
and eax, 0xff
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
mov eax, dword [esp + 0x18]
and eax, 0xff
lea ecx, [esp + 0x10]
lea edi, [eax + edx*2 - 0x6db]
call fcn.1007ba09
push edi
push 0
lea ecx, [esp + 0x14]
call fcn.1007bd0e
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call fcn.1007bc24
mov ecx, dword [esp + 0x30]
inc esi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jl 0x1002a842
pop edi
lea edx, [esp + 4]
lea ecx, [esp + 0x2c]
push edx
call fcn.1007b9b9
mov edx, dword [esp + 0x2c]
xor esi, esi
mov eax, dword [edx - 8]
test eax, eax
jle 0x1002a90d
push ebx
mov ebx, dword [esp + 0x34]
mov dl, byte [esi + edx]
xor eax, eax
mov al, bh
lea ecx, [esp + 8]
xor al, dl
push eax
push esi
call fcn.1007bd0e
mov edx, dword [esp + 0x30]
movzx ax, byte [esi + edx]
add eax, ebx
mov ebx, 0x58bf
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea eax, [eax + ecx*2]
sub ebx, eax
mov eax, dword [edx - 8]
inc esi
cmp esi, eax
jl 0x1002a8ca
pop ebx
mov esi, dword [esp + 0x28]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.1007b641
mov dword [esp + 0x14], 1
mov byte [esp + 0x20], 2
lea ecx, [esp + 8]
call fcn.1007b8cc
mov byte [esp + 0x20], 1
lea ecx, [esp + 4]
call fcn.1007b8cc
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x2c]
call fcn.1007b8cc
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x1002b740
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100880b8
push 0x10048df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x1002b79c
push 0
mov eax, dword [eax + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi], 0
jmp 0x1002b79c
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret