joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaec250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb00808
push 0xaf0288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xaec329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xaec329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00aef1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xaec329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xaec329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xaec32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00aec351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xaecd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xaecd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xaecd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xaecd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xaecd94
push eax
push esi
call fcn.00aef20b
add esp, 8
pop esi
ret 0x10

Function at 0xaecda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xaece22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xaece15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xb05320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00aeedff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xaecdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xaece30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xaecec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xaeceb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xb05320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00aeedff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xaeceab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xaece6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xaed000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xaed131
push esi
call fcn.00af0145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00adf080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xaed131
push 0
push ebp
call fcn.00adf3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00adf260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xaed08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00adf2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xaed121
push 0xb05918
push edi
call fcn.00aee3f0
push eax
push ebx
push esi
call fcn.00aecf60
push 0xb058f8
push edi
call fcn.00aee3f0
push eax
push ebx
push esi
call fcn.00aecf60
push 0xb058d8
push edi
call fcn.00aee3f0
push eax
push ebx
push esi
call fcn.00aecf60
push 0xb058c0
push edi
call fcn.00aee3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00aecf60
push 0xb058a0
push edi
call fcn.00aee3f0
push eax
push ebx
push esi
call fcn.00aecf60
push 0xb05888
push edi
call fcn.00aee3f0
push eax
push ebx
push esi
call fcn.00aecf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xaee1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00aee140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00aee140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00aee140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00aee140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xaeebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xaeec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb0087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xaeec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xaeec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10001071
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x10001071
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1000105a
jmp 0x10001071
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x100036f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [0x1004717c]
push eax
push 0x40
push 1
push edi
mov dword [ebp - 4], 0
call ebx
test eax, eax
je 0x10003741
push 0x40
push 0x3000
push 1
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
jne 0x1000374a
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 1
push edi
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov dword [ecx], eax
mov al, byte [edi + 4]
mov byte [ecx + 4], al
mov eax, edi
sub eax, ecx
mov byte [ecx + 5], 0xe9
sub eax, 5
mov dword [ecx + 6], eax
mov eax, dword [edi]
mov dword [0x10056df0], eax
mov eax, dword [edi + 4]
mov dword [0x10056df4], eax
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x14], eax
mov eax, 0x10023050
sub eax, edi
mov byte [ebp - 0x18], 0xe9
sub eax, 5
mov dword [ebp - 0x17], eax
lea ecx, [ecx]
mov esi, dword [edi]
mov eax, esi
mov ecx, dword [edi + 4]
mov edx, ecx
mov dword [ebp - 8], ecx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
lock cmpxchg8b qword [edi]
cmp eax, esi
jne 0x10003790
cmp edx, dword [ebp - 8]
jne 0x10003790
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100037d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [0x10047590]
push ebx
push esi
push edi
mov eax, dword [ecx + 5]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 9]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov ebx, dword [ebp - 0xf]
push eax
push 0x40
add ebx, 5
mov dword [ebp - 0x14], ecx
add ebx, ecx
mov dword [ebp - 8], 0
push 1
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10003821
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 4]
mov esi, dword [ebx]
mov eax, esi
mov edi, dword [ebx + 4]
mov edx, edi
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
lock cmpxchg8b qword [edi]
mov edi, dword [ebp - 0xc]
cmp eax, esi
jne 0x1000381e
cmp edx, edi
jne 0x1000381e
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x8000
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006050
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x2c], 0
je 0x100060a1
push esi
mov esi, dword [edi]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0x100587e8
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
test eax, eax
je 0x100060a1
mov eax, dword [edi + 0x24]
mov ecx, dword [edi]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov dword [edi + 0x2c], 0
xor eax, eax
cmp dword [edi + 0x2c], eax
pop edi
sete al
ret
Function at 0x10022190
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push dword [ebp + 8]
mov edi, ecx
mov byte [ebp - 1], 0
lea ebx, [edi + 0x44]
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebx], xmm0
mov word [ebx], ax
call dword [0x10045ca4]
mov ecx, eax
mov dword [edi + 0x524], ecx
test ecx, ecx
jne 0x100221d4
mov ecx, edi
call fcn.10022b10
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
movsx eax, word [ecx + 0xa]
push eax
mov eax, dword [ecx + 0xc]
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.100099f0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [edi + 0x48], eax
cmp eax, 0xffffffff
je 0x100221c3
push dword [ebp + 0xc]
call dword [0x10045cb8]
mov word [edi + 0x46], ax
xorps xmm0, xmm0
lea eax, [edi + 0x78]
push eax
movups xmmword [eax], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x10
push ebx
push dword [edi + 4]
call dword [0x10045cb0]
movzx ebx, byte [ebp - 1]
cmp eax, 0xffffffff
mov ecx, 1
cmovne ebx, ecx
mov ecx, edi
call fcn.10022b10
lea ecx, [edi + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10022250
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xorps xmm0, xmm0
push edi
push dword [ebp + 8]
lea edi, [esi + 0x44]
mov eax, 2
movdqu xmmword [edi], xmm0
xor bl, bl
mov word [edi], ax
call dword [0x10045ca4]
mov ecx, eax
mov dword [esi + 0x524], ecx
test ecx, ecx
jne 0x10022291
mov ecx, esi
call fcn.10022b10
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
movsx eax, word [ecx + 0xa]
push eax
mov eax, dword [ecx + 0xc]
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.100099f0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esi + 0x48], eax
cmp eax, 0xffffffff
je 0x10022281
push dword [ebp + 0xc]
call dword [0x10045cb8]
mov word [esi + 0x46], ax
xorps xmm0, xmm0
lea eax, [esi + 0x78]
push eax
movups xmmword [eax], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x10
push edi
push dword [esi + 4]
call dword [0x10045cb0]
mov ecx, esi
cmp eax, 0xffffffff
jne 0x100222e9
call fcn.10022b10
jmp 0x100222f0
call fcn.10022b10
mov bl, 1
lea ecx, [esi + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x100227f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push edi
push 0
mov dword [ebp - 4], ecx
or edi, 0xffffffff
push dword [eax]
push dword [ebp + 0xc]
call fcn.1001c5bc
add esp, 0xc
cmp eax, edi
jne 0x1002281a
or eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov ebx, dword [ebp + 0x14]
push esi
cmp ebx, 0xffffffff
jle 0x10022862
mov eax, ebx
mov esi, 0x2000
sub eax, edi
cmp eax, esi
cmovl esi, eax
push esi
push 0x1005b800
push dword [ebp + 0xc]
call fcn.100187bb
add esp, 0xc
cmp eax, esi
jne 0x1002287a
push 0
push esi
push 0x1005b800
push dword [ebp + 8]
call dword [0x10042c74]
cmp eax, esi
jne 0x1002287a
add edi, esi
cmp edi, ebx
jl 0x10022824
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
add dword [eax], edi
call fcn.10022b10
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x10
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100229c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
mov dword [esi + 0x1c], 0
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x10022afd
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x10022a1c
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10022a04
cmp edi, dword [esi + 0x10]
je 0x10022a04
push eax
call fcn.1000775e
add esp, 4
mov dword [esi + 0xc], 0
cmp dword [esi + 0xc], 0
jne 0x10022a19
push edi
mov dword [esi + 0x10], edi
call fcn.100079c2
add esp, 4
mov dword [esi + 0xc], eax
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x78]
mov dword [esi + 8], 0
xorps xmm0, xmm0
push eax
movups xmmword [eax], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi + 0x18]
dec eax
je 0x10022aa7
dec eax
jne 0x10022aca
cmp byte [esi + 0x29], 1
mov dword [ebp + 0xc], 0x10
jne 0x10022a77
lea eax, [esi + 0x64]
lea ecx, [ebp + 0xc]
push ecx
push eax
push 0
push edi
push ebx
push dword [esi + 4]
call dword [0x100470f4]
mov ecx, esi
mov dword [esi + 0x1c], eax
call fcn.10022b10
cmp dword [esi + 8], 9
lea eax, [esi + 0x64]
je 0x10022a50
jmp 0x10022aca
lea eax, [esi + 0x54]
lea ebx, [ebx]
lea ecx, [ebp + 0xc]
push ecx
push eax
push 0
push edi
push ebx
push dword [esi + 4]
call dword [0x100470f4]
mov ecx, esi
mov dword [esi + 0x1c], eax
call fcn.10022b10
cmp dword [esi + 8], 9
lea eax, [esi + 0x54]
je 0x10022a80
jmp 0x10022aca
push dword [esi + 0x24]
mov eax, dword [esi + 0x1c]
push edi
add eax, ebx
push eax
push dword [esi + 4]
call dword [0x10042c68]
mov ecx, esi
mov dword [esi + 0x1c], eax
call fcn.10022b10
cmp dword [esi + 8], 9
je 0x10022aa7
lea eax, [esi + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, esi
call fcn.10022b10
cmp dword [esi + 0x1c], 0xffffffff
pop edi
pop ebx
jne 0x10022afd
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10022afd
push eax
call fcn.1000775e
add esp, 4
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x1c]
pop esi
pop ebp
ret 8
Function at 0x10022cb0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.10007d87
push 0x190
lea esi, [edi + 0x88]
push 0
push esi
mov dword [eax], 0
call fcn.1000b180
add esp, 0xc
push esi
push 2
call dword [0x10045ca8]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x78]
xorps xmm0, xmm0
push eax
movups xmmword [eax], xmm0
call esi
push 0
push 2
push dword [edi + 0x14]
call dword [0x10042c6c]
mov dword [edi + 4], eax
lea eax, [edi + 0x80]
push eax
call esi
mov ecx, edi
call fcn.10022b10
mov eax, dword [edi]
mov ecx, edi
pop edi
pop esi
mov eax, dword [eax + 0x10]
jmp eax

Function at 0x10026460
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1004074c]
xor eax, ebp
mov dword [ebp - 4], eax
dec dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
je 0x1002648f
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006ce7
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.10008aad
add esp, 4
lea eax, [ebp - 0x110]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov edi, eax
lea eax, [ebp - 0x110]
sub edi, eax
cmp edi, 0x7ffffffe
jbe 0x100264da
mov byte [0x10047b80], 0
jmp 0x10026511
mov ecx, 0x10047b80
lea esi, [ebp - 0x110]
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea eax, [edi - 0x104]
add eax, edx
je 0x10026509
mov al, byte [esi + ecx]
test al, al
je 0x10026509
mov byte [ecx], al
inc ecx
dec edx
jne 0x100264f0
jmp 0x1002650d
test edx, edx
jne 0x1002650e
dec ecx
mov byte [ecx], 0
mov dword [ebp - 0xc], 0xc9cec98e
lea eax, [ebp - 0xc]
mov byte [ebp - 8], 0
pop edi
add byte [eax], 0xa0
lea eax, [eax + 1]
cmp byte [eax], 0
jne 0x10026520
lea eax, [ebp - 0xc]
push eax
call fcn.100041e0
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0xc]
je 0x1002654b
lea ecx, [ecx]
add byte [eax], 0x60
lea eax, [eax + 1]
cmp byte [eax], 0
jne 0x10026540
push 0
push 0
push 0
push 0x10026d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.10026580
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.10006ce7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402ef0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5b5d14]
sub esp, 0x1c
push ebx
push esi
push edi
test eax, eax
jne 0x402fe8
mov eax, dword fs:[0x30]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, 0x694a8c81
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x30]
test ebx, ebx
je 0x402f5a
add eax, 0xfffffff8
mov edx, 0x811c9dc5
movzx eax, ax
shr eax, 1
lea esi, [ecx + eax*2]
cmp ecx, esi
je 0x402f56
movsx eax, byte [ecx]
add ecx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jne 0x402f44
cmp edx, ebx
jne 0x402fc8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 0x18], eax
lea eax, [ecx + edx]
mov dword [ebp - 0x14], eax
cmp eax, edx
je 0x402fc8
mov esi, dword [eax + 0x18]
test esi, esi
je 0x402fc8
mov eax, dword [eax + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
nop word [eax + eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec esi
mov edx, 0x811c9dc5
mov al, byte [ecx]
inc ecx
test al, al
je 0x402fba
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx - 1]
test al, al
jne 0x402fa5
cmp edx, edi
mov edx, dword [ebp - 0xc]
je 0x402ff1
test esi, esi
jne 0x402f90
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x10]
je 0x402fe1
cmp dword [ecx + 0x18], 0
jne 0x402f26
xor eax, eax
mov dword [0x5b5d14], eax
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x14]
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
cmp eax, edi
jbe 0x402fe3
mov ecx, dword [ebp - 0x18]
add ecx, edi
cmp eax, ecx
jae 0x402fe3
mov cl, byte [eax]
mov ebx, 0x811c9dc5
mov dword [ebp - 8], ebx
mov edi, ebx
cmp cl, 0x2e
je 0x40303d
movsx ecx, cl
inc eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
mov cl, byte [eax]
cmp cl, 0x2e
jne 0x403027
mov dword [ebp - 8], ebx
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x403059
movsx ecx, cl
lea eax, [eax + 1]
xor ecx, edi
imul edi, ecx, 0x1000193
mov cl, byte [eax]
test cl, cl
jne 0x403045
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
jmp 0x402fcb
Function at 0x406d90
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45118d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x49e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, 0x10
lea ecx, [ebp - 0x40]
call fcn.00406ca0
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00410ed0
mov ecx, dword [ebp - 0x2c]
add esp, 4
cmp ecx, 0xf
jbe 0x406e0e
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406e04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406e04
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0044fd86
add esp, 8
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x406e56
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406e4c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406e4c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0044fd86
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044fd73
mov esp, ebp
pop ebp
ret