joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40340f
pop dword [ebp - 0x40]
mov eax, 0x8413b239
add eax, 0x7c2c81d6
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb28e3765
sub dword [ebp - 0x50], 0x643bf21a
mov dword [ebp - 0x4c], 0x5b0e4446
add dword [ebp - 0x4c], 0xd72507ff
mov dword [ebp - 0x48], 0xe71c7f76
sub dword [ebp - 0x48], 0x9ad03b48
mov dword [ebp - 0x44], 0xea532b75
add dword [ebp - 0x44], 0x15acd48b
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x75b5b32
sub dword [ebp - 0x50], 0x92e8f1dc
mov dword [ebp - 0x4c], 0xac41111b
sub dword [ebp - 0x4c], 0x6ad4afa6
mov dword [ebp - 0x48], 0xf06ae1df
sub dword [ebp - 0x48], 0x8cfb7573
mov dword [ebp - 0x44], 0xf832f557
sub dword [ebp - 0x44], 0xf832f557
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xe23f3a59
sub eax, 0xe1fe0a1d
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3df7c
push 0
call eax
mov ecx, 0x1be2a9f1
sub ecx, 0x1be2549d
mov edi, eax
mov ebx, 0xea21cace
sub ebx, 0xe9e02ace
add ebx, dword [ebp - 0x40]
mov edx, 0x3c799d28
sub edx, 0xfd803f5f
mov dword [ebp - 0x1c], 0x39ca8caf
mov esi, dword [ebx]
sub dword [ebp - 0x10], esi
xor esi, edx
add dword [ebp - 0x3c], 0xd07b055b
mov dword [edi], esi
add dword [ebp - 0xc], 0x3483782f
add edi, 4
add ebx, 0x3cc85075
add ebx, 0xc337af8f
loop 0x40352c
add eax, 0xe2b75e48
sub eax, 0xe2b61625
mov ebx, eax
add eax, 5
mov ecx, 0xbb40657
sub ecx, 0xb740657
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x410280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41029c
mov dword [eax], ecx
jmp 0x41029e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410310
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40e92c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ff68]
jne 0x40e936
repz ret
jmp fcn.0041725c

Function at 0x41b1e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410b2a
and dword [ebp - 4], 0
cmp dword [0x48302c], 0
mov ebx, eax
jne 0x41b298
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41b349
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x429b78
push edi
call esi
test eax, eax
je 0x41b349
push eax
call fcn.00410ab8
mov dword [esp], 0x429b68
push edi
mov dword [0x48302c], eax
call esi
push eax
call fcn.00410ab8
mov dword [esp], 0x429b54
push edi
mov dword [0x483030], eax
call esi
push eax
call fcn.00410ab8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x483034], eax
call esi
push eax
call fcn.00410ab8
pop ecx
mov dword [0x48303c], eax
test eax, eax
je 0x41b298
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410ab8
pop ecx
mov dword [0x483038], eax
mov eax, dword [0x483038]
cmp eax, ebx
je 0x41b2f0
cmp dword [0x48303c], ebx
je 0x41b2f0
push eax
call fcn.00410b33
push dword [0x48303c]
mov esi, eax
call fcn.00410b33
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41b2f0
test edi, edi
je 0x41b2f0
call esi
test eax, eax
je 0x41b2e7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41b2e7
test byte [ebp - 0xc], 1
jne 0x41b2f0
or dword [ebp + 0x10], 0x200000
jmp 0x41b329
mov eax, dword [0x483030]
cmp eax, ebx
je 0x41b329
push eax
call fcn.00410b33
pop ecx
test eax, eax
je 0x41b329
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41b329
mov eax, dword [0x483034]
cmp eax, ebx
je 0x41b329
push eax
call fcn.00410b33
pop ecx
test eax, eax
je 0x41b329
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48302c]
call fcn.00410b33
pop ecx
test eax, eax
je 0x41b349
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41b34b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10004941
push eax
push esi
push dword [ebp + 8]
call fcn.100048f6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
fsub dword [edi - 0x3a]
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10004dcc
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10004941
push eax
push esi
push dword [ebp + 8]
call fcn.100048f6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10004931
lahf
mov cl, 0x5c
cld
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
Function at 0x10004d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10004941
push eax
push esi
push dword [ebp + 8]
call fcn.100048f6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
fsub dword [edi - 0x3a]
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10004dcc
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10004941
push eax
push esi
push dword [ebp + 8]
call fcn.100048f6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10004931
lahf
mov cl, 0x5c
cld
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
Function at 0x10005050
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10005008
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10005026
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10005084
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000506b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10005074
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000507e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10005060
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10004fea
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100050d1
dec eax
je 0x100050c8
sub eax, 3
je 0x100050bf
mov dword [ebp - 4], 0x40
jmp 0x100050ee
mov dword [ebp - 4], 4
jmp 0x100050d4
mov dword [ebp - 4], 0x20
jmp 0x100050d4
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10005120
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100050a0
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10004931
and al, 0xce
push ecx
pop esp
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x1000512c

Function at 0x10005610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xfffffc
je 0x100057ef
cmp dword [ebp + 0xc], 1
je 0x100057ef
cmp dword [ebp + 0xc], 8
jne 0x100057b7
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
invalid
test dword [ecx + edi*8 - 1], ecx
Function at 0x10005830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1000490f
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10004941
pop ecx
push eax

Function at 0x10007a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10007a69
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007aa4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10007aa0
lea ebx, [ebx]
cmp esi, eax
jae 0x10007aa4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10007a90
cmp esi, eax
jb 0x10007aaa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10008870
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
push eax
push 0x20
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10008900
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x100088b9
push str.Cant___lookup___privilege___value._n
call fcn.100201d3
add esp, 4
mov eax, dword [esp + 4]
push 0
push 0
push 0x10
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x100088ea
push str.Cant___adjust___privilege___value._n
call fcn.100201d3
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 4]
test eax, eax
push ecx
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
add esp, 0x18
ret
Function at 0x1000c8f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100383e0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push edi
mov eax, dword [0x10045c94]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
push str.mdminf
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.10008030
push str.Path
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.10008030
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 1
call fcn.10011a50
add esp, 4
mov byte [esp + 0x38], 3
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000c981
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 4
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000c9a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
call fcn.1000c6b0
mov byte [esp + 0x38], 5
mov edx, dword [esp + 0x10]
mov ecx, eax
call fcn.1000d9b0
cmp dword [esp + 0x2c], 8
jb 0x1000c9d3
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100128fb
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x10]
xor edx, edx
add eax, 0xfffffff0
mov word [esp + 0x18], dx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ca12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x34
ret
Function at 0x1000ca30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100383e0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push edi
mov eax, dword [0x10045c94]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
push str.serinf
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.10008030
push str.Path
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.10008030
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 1
call fcn.10011a50
add esp, 4
mov byte [esp + 0x38], 3
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000cac1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 4
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000cae6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
call fcn.1000c6b0
mov byte [esp + 0x38], 5
mov edx, dword [esp + 0x10]
mov ecx, eax
call fcn.1000d9b0
cmp dword [esp + 0x2c], 8
jb 0x1000cb13
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100128fb
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x10]
xor edx, edx
add eax, 0xfffffff0
mov word [esp + 0x18], dx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000cb52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x34
ret
Function at 0x1000d730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003862b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x10045c94]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push esi
push edi
mov eax, dword [0x10045c94]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14c], ebx
call fcn.10009340
add esp, 4
test al, al
je 0x1000d85a
push 0x103
lea edx, [esp + 0x31]
push ebx
push edx
call fcn.10021820
add esp, 0xc
mov byte [esp + 0x2c], 0x71
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
call fcn.100116e0
cmp eax, 4
jne 0x1000d7d4
mov byte [esp + 0x2d], 1
mov byte [esp + 0x2e], bl
call fcn.100116e0
cmp eax, 3
jne 0x1000d7e8
mov al, 2
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], al
call fcn.100116e0
cmp eax, 6
jne 0x1000d7fb
mov byte [esp + 0x2d], 3
mov byte [esp + 0x2e], bl
lea eax, [esp + 0x2c]
push 3
push eax
lea esi, [esp + 0x18]
call fcn.10008910
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
call esi
mov edi, eax
call fcn.10009160
test al, al
jne 0x1000d842
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call ebx
call esi
sub eax, edi
cmp eax, 0x7530
ja 0x1000d85a
call fcn.10009160
test al, al
je 0x1000d827
cmp dword [esp + 0x28], 8
jb 0x1000d856
mov ecx, dword [esp + 0x14]
push ecx
call fcn.100128fb
add esp, 4
mov al, 1
jmp 0x1000d870
cmp dword [esp + 0x28], 8
jb 0x1000d86e
mov edx, dword [esp + 0x14]
push edx
call fcn.100128fb
add esp, 4
xor al, al
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1001ec96
mov esp, ebp
pop ebp
ret

Function at 0x1000d9b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x10037588
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x10045c94]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, edx
xor ebx, ebx
push 0xffffffffffffffff
push ebx
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
call fcn.10001450
mov eax, esi
mov dword [esp + 0x34], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1000da06
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.10009d60
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push eax
mov ecx, edi
mov word [edi + 4], dx
call fcn.10001450
cmp dword [esp + 0x28], 8
jb 0x1000da4f
mov eax, dword [esp + 0x14]
push eax
call fcn.100128fb
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x1000e5c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003752e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10045c94]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov ecx, 7
xor eax, eax
xor edx, edx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov word [esi + 4], dx
mov dword [esp + 0x14], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov word [esi + 0x20], ax
lea ecx, [esi + 0x38]
push ecx
mov byte [esp + 0x18], 1
call fcn.1000edc0
lea edx, [esi + 0x50]
push edx
mov byte [esp + 0x18], 2
call fcn.1000edc0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x100116e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x10045c94]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 4
jne 0x10011760
mov eax, dword [esp + 8]
cmp eax, 0xa
jne 0x1001173a
mov eax, 1
cmp dword [esp + 0x10], eax
je 0x10011725
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1001ec96
add esp, 0x118
ret
cmp eax, 0x5a
jne 0x10011723
cmp dword [esp + 0x10], 1
jne 0x10011723
mov eax, 2
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1001ec96
add esp, 0x118
ret
cmp eax, 5
jne 0x100117e1
mov eax, dword [esp + 8]
test eax, eax
jne 0x1001178e
cmp dword [esp + 0x10], 2
jne 0x10011723
mov eax, 3
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1001ec96
add esp, 0x118
ret
cmp eax, 1
jne 0x100117b4
cmp dword [esp + 0x10], 2
jne 0x10011723
mov eax, 4
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1001ec96
add esp, 0x118
ret
cmp eax, 2
jne 0x10011723
cmp dword [esp + 0x10], eax
jne 0x10011723
mov eax, 5
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1001ec96
add esp, 0x118
ret
cmp eax, 6
jne 0x10011723
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1001ec96
add esp, 0x118
ret

Function at 0x100125a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10037033
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10045c94]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
push esi
mov dword [esp + 0x18], 1
call fcn.10034a6c
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0x100125f1
mov eax, dword [esi + 0x1c]
push eax
call fcn.100128fb
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x1001ec96
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10045c94]
jne 0x1001eca0
repz ret
jmp fcn.100237bf