joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003420
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
mov esi, dword [0x10119680]
cmp byte [esi + 0x30d5c], 0
jne 0x10003440
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1000344d
mov eax, dword [ecx]
push ecx
call dword [eax + 0x34]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1000345a
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov edx, dword [esi]
push 0
mov eax, dword [edx]
mov ecx, dword [eax + 0x5c]
lea eax, [esi + 0xc]
push eax
push 0
push 0x15
push 1
push 1
push 0x200
push 0x200
push edx
call ecx
test eax, eax
je 0x1000343b
movaps xmm0, xmmword [0x100d24a0]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0x4552480a
push eax
movups xmmword [ebp - 0x30], xmm0
lea eax, [ebp - 0x24c]
mov dword [ebp - 0xc], 0x544c5553
movaps xmm0, xmmword [str._render_target._rSFF__s__d.sff___s_r_nErrorID:___d._r_nRequested_ScrItemListInfo_Could_not_load__SFF_scr__d.sffHeadersCanvas1.DonationCanvas1DonationCanvas2CPortalUI_Tier::CItemsPreviews::_font._r_nHRESULT:]
push eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x3025203a
mov word [ebp - 4], 0x5838
mov byte [ebp - 2], 0
call fcn.10003db0
movaps xmm0, xmmword [0x100d2630]
lea eax, [ebp - 0x58]
add esp, 0xc
mov byte [ebp - 0x38], 0
movups xmmword [ebp - 0x58], xmm0
movaps xmm0, xmmword [0x100d24b0]
push 0x50010
push eax
lea eax, [ebp - 0x24c]
push eax
push 0
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000a8f0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f4c
call fcn.10098130
mov dword [ebp - 0x10], ecx
push 0x100cda9e
jmp loc.10219a57
Function at 0x1000ca70
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1e70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x16d0
call fcn.10098130
mov dword [ebp - 0x10], ecx
push 0x100cda9e
jmp loc.10219fe2

Function at 0x10015dd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
push edi
mov ebx, ecx
push 0x100cda9e
mov dword [ebp - 0x24], ebx
jmp 0x1002c898
call fcn.10036e00
lea esi, [ebx + 0x1c]
sete dh
mov dword [ebp - 0x20], 0x706f6853
movzx edx, cx
movsx ecx, dx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], 0x702e4955
mov edx, 0x420ae73c
jmp 0x1002a987
push esi
push ecx
lea edx, [ebp - 0x20]
xchg cl, ch
mov word [ebp - 0x18], 0x7a65
cmovo cx, di
mov ecx, eax
jmp loc.10216767
lea esp, [esp + 4]
jmp 0x10026f30
Function at 0x1001cf90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1fed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
lea eax, [ebx + 0x68]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], eax
mov dword [ebx], 0x100cefd4
mov dword [ebx + 0x10], 0x100cefcc
push esi
push edi
mov dword [eax], 0x100cefb8
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x100cefbc
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov byte [eax + 0x40], 0
mov dword [ebp - 4], 1
lea esi, [ebx + 0x18]
mov eax, dword [ebx]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x100cefc0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, ebx
push ecx
push esi
call fcn.1001f2a0
mov dword [ebp - 4], 4
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax + 0x10], 0x100cefc4
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx + 0xc], eax
mov dword [ebp - 4], 6
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x100cefc8
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + ebx - 4], eax
mov dword [ebp - 4], 7
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x100cefdc
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.1001ee60
mov byte [ebp - 4], 8
mov dword [esi], 0x100cf01c
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10021680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c278f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.10082c07
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x10021726
push eax
push esi
call fcn.10082ac5
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.10080666
int3
Function at 0x10022800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov ecx, dword [0x10119ebc]
call fcn.10036e00
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.d3dx9_43.dll_D3DXCreateSprite]
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x67
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x20
mov byte [ebp - 0x12], 0x55
mov byte [ebp - 0x11], 0x49
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0
mov edx, dword [ebp - 4]
add edx, 8
push edx
lea eax, [ebp - 0x18]
push eax
push 0
push 5
push 0
push 1
push 0
push 1
push 0x2bc
push 0
imul eax, dword [0x1010ba78], 0xfffffff4
cdq
mov ecx, 0x48
idiv ecx
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
push 0x96ff0000
mov eax, dword [ebp - 4]
add eax, 0x927e4
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [0x10119ec0]
call fcn.1002acb0
push 0x9600ff00
mov edx, dword [ebp - 4]
add edx, 0x927e8
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x10119ec0]
call fcn.1002acb0
push 0x960000ff
mov ecx, dword [ebp - 4]
add ecx, 0x927ec
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x10119ec0]
call fcn.1002acb0
push 0x96ef00ff
mov eax, dword [ebp - 4]
add eax, 0x927f0
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [0x10119ec0]
call fcn.1002acb0
push 0x9600deff
mov edx, dword [ebp - 4]
add edx, 0x927f4
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x10119ec0]
call fcn.1002acb0
push 0x96ff9a00
mov ecx, dword [ebp - 4]
add ecx, 0x927f8
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x10119ec0]
call fcn.1002acb0
mov eax, dword [ebp - 4]
mov byte [eax], 1
mov esp, ebp
pop ebp
ret

Function at 0x10022e70
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov dword [ebp - 8], ecx
push 0x100cda9e
jmp loc.10261c07

Function at 0x10024570
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
mov eax, dword [ebp - 0x20]
mov cx, dx
shr cx, cl
movzx ecx, byte [eax + 0x10]
cmp edi, ebx
test ecx, ecx
jmp loc.10209a13
push ebp
mov ebp, esp
sub esp, 0xf8
push esi
mov dword [ebp - 0x20], ecx
push 0x100cda9e
jmp 0x10001500

Function at 0x10024c90
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x54], ecx
push 0x100cda9e
jmp loc.10259a5d

Function at 0x100254b0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x27b4
call fcn.10098130
mov dword [ebp - 0xc], ecx
push 0x100cda9e
jmp loc.1026ec06
Function at 0x100259a0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
mov dword [ebp - 0x1cc], ecx
mov eax, dword [0x10119f38]
add eax, 0x28e13c
cmp dword [ebp + 8], eax
jne 0x10026621
push 0x100cda9e
jmp loc.10211ea3
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100267e0
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c2960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xae4
mov dword [ebp - 0x30], ecx
push 0x100cda9e
jmp loc.1023d764

Function at 0x10027850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [ecx + 0x272c]
inc edx
mov dword [ecx], eax
shld edx, edx, 0xbe
shr edx, 0x11
mov dword [ecx + 4], eax
sal dl, cl
mov dword [ecx + 8], eax
rcl dx, 0x1f
mov dword [ecx + 0xc], eax
push 0x2280
bts dx, sp
test edi, edi
push 0
btr edx, ebx
mov edx, dword [ebp - 4]
add edx, 0x273c
jmp 0x1006bc30
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
push 0x100cda9e
jmp 0x1007a504
call fcn.100994f0
add esp, 0xc
not ecx
bswap cx
mov ecx, dword [0x10119ebc]
jmp loc.10274931
push edx
jmp 0x1006b4c9
lea esp, [esp + 4]
sub eax, eax
adc cx, di
sub edx, edx
shl dh, cl
mov ecx, dword [ebp - 4]
jmp 0x10002f2c

Function at 0x10027950
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov dword [ebp - 4], ecx
push 0x100cda9e
jmp 0x10028087
lea esp, [esp + 4]
mov ecx, dword [0x10119ebc]
jmp loc.1020201d
Function at 0x100287c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
cmovg eax, edi
bswap eax
push 0x7d0
mov eax, 0xa093951c
movsx eax, bx
push 0
movsx eax, di
cwde
lahf
lea eax, [ebp - 0xfc0]
push eax
jmp 0x100801d7
push ebp
mov ebp, esp
sub esp, 0xfc0
mov dword [ebp - 0x20], ecx
push 0x100cda9e
jmp 0x100119ae
call fcn.100994f0
add esp, 0xc
setg cl
xchg cl, ch
jmp loc.10221d9e

Function at 0x100288f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov dword [ebp - 0xc], ecx
push 0x100cda9e
jmp 0x1003c730
lea esp, [esp + 4]
movzx eax, ax
movsx ax, dh
mov eax, dword [ebp - 0xc]
jmp fcn.1022789c

Function at 0x10028cf0
Capabilities:
Encode data using xor

Disassembly:
push 0x100293a0
jmp fcn.10228d78
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100c29e1
push eax
mov dword fs:[0], esp
sub esp, 0x14
xor ecx, ecx
push esi
mov esi, dword [0x10119ec0]
nop dword [eax]
nop dword [eax + eax]
movzx eax, cl
imul eax, eax, 0x8b
xor byte [ecx + 0x1010ba80], al
inc ecx
cmp ecx, 0x3de9
jb 0x10028d20
push 0x40
xorps xmm0, xmm0
lea eax, [esi + 0x18]
push 0
movups xmmword [esi], xmm0
push eax
movq qword [esi + 0x10], xmm0
call fcn.100994f0
push 0x40
lea eax, [esi + 0x58]
push 0
push eax
call fcn.100994f0
push 0x40
lea eax, [esi + 0x98]
push 0
push eax
call fcn.100994f0
push 0x64
xorps xmm0, xmm0
push 0
movq qword [esi + 0xe8], xmm0
push 0x1011a310
mov dword [esi + 0xf0], 0
call fcn.100994f0
add esp, 0x30
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
push 0x100cda9e
jmp 0x1007eb80
lea esp, [esp + 4]
mov eax, dword [0x10119f38]
cmp bp, cx
cmp edx, 0x873ef080
push 9
cmp ecx, esp
cmp sp, 0xdc8e
add eax, 0x3f0c30
jmp 0x10016c4f

Function at 0x10034070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
push str.BullSF_Client
call dword [sym.imp.BugTrapU.dll_BT_SetAppName]
push 0x19d
call dword [sym.imp.BugTrapU.dll_BT_SetFlags]
push str.https:__sf.bullgamez.com
call dword [sym.imp.BugTrapU.dll_BT_SetSupportURL]
xor eax, eax
mov dword [ebp - 0xc], 0x730025
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x30]
push eax
push dword [0x10119ec4]
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x25005c
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 0x73
push eax
mov dword [ebp - 0x30], 0x720043
mov dword [ebp - 0x2c], 0x730061
mov dword [ebp - 0x28], 0x440068
mov dword [ebp - 0x24], 0x740065
mov dword [ebp - 0x20], 0x690061
mov dword [ebp - 0x1c], 0x73006c
mov dword [ebp - 0x18], 0x62002e
mov dword [ebp - 0x14], 0x780074
call fcn.1000a8a0
add esp, 0x10
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.BugTrapU.dll_BT_AddLogFile]
call dword [sym.imp.BugTrapU.dll_BT_InstallSehFilter]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100348b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100348c3
test al, 0x10
jne 0x100348c3
mov al, 1
ret
xor al, al
ret
Function at 0x10035ba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1dd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
cmp dword [ebp + 0xc], 1
mov edx, ecx
push ebx
sete al
mov dword [ebp - 0x10], edx
push esi
mov byte [edx + 0x48], al
lea ebx, [edx + 4]
mov eax, dword [ebp - 0x10]
lea esi, [edx + 8]
mov dword [edx + 0xc], ebx
lea ecx, [edx + 0x18]
mov dword [edx + 0x10], esi
mov byte [edx + 0x3d], 0
mov dword [edx + 0x20], ecx
push edi
lea edi, [edx + 0x14]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [edx + 0x1c], edi
add edx, 0x24
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp + 0xc]
mov dword [esi], 0
mov esi, dword [ebp + 8]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
test esi, esi
je 0x10035c76
lea eax, [ebp - 0x14]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], 0
push eax
push esi
call fcn.100a150a
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
jmp 0x10035c79
mov edx, dword [ebp - 0x10]
mov ecx, dword [0x101ff720]
mov eax, dword [0x101ff71c]
pop edi
mov dword [edx + 0x4c], esi
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [edx + 0x40], eax
mov dword [edx + 0x38], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x10037870
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c2d67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1684
call fcn.10098130
push ebx
mov dword [ebp - 0x18], ecx
push 0x100cda9e
jmp fcn.102298de
Function at 0x100384a0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
mov esi, dword [0x1011a30c]
push edi
cmp byte [esi], 0
jne 0x1003869f
call fcn.10036e00
push 0
lea ecx, [esi + 4]
mov edi, eax
push ecx
push 0x14
push 0x14
push ecx
mov dword [esp], 0x40a00000
push edi
call dword [sym.imp.d3dx9_43.dll_D3DXCreateSphere]
test eax, eax
je 0x100385f7
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x330044
push eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x74], 0x580044
xor ecx, ecx
mov dword [ebp - 0x70], 0x720043
push eax
mov dword [ebp - 0x6c], 0x610065
mov dword [ebp - 0x68], 0x650074
mov dword [ebp - 0x64], 0x700053
mov dword [ebp - 0x60], 0x650068
mov dword [ebp - 0x5c], 0x650072
mov dword [ebp - 0x58], 0x700028
mov dword [ebp - 0x54], 0x780044
mov dword [ebp - 0x50], 0x440033
mov dword [ebp - 0x4c], 0x700053
mov dword [ebp - 0x48], 0x650068
mov dword [ebp - 0x44], 0x650072
mov dword [ebp - 0x40], 0x290047
mov dword [ebp - 0x3c], 0x460020
mov dword [ebp - 0x38], 0x690061
mov dword [ebp - 0x34], 0x65006c
mov dword [ebp - 0x30], 0x2e0064
mov dword [ebp - 0x2c], 0xa000d
mov dword [ebp - 0x28], 0x720045
mov dword [ebp - 0x24], 0x6f0072
mov dword [ebp - 0x20], 0x3a0072
mov dword [ebp - 0x1c], 0x250020
mov dword [ebp - 0x18], 0x380030
mov dword [ebp - 0x14], 0x58
mov dword [ebp - 0x10], 0x6c0043
mov dword [ebp - 0xc], 0x650069
mov dword [ebp - 8], 0x74006e
mov word [ebp - 4], cx
call fcn.1002ad60
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x50010
push eax
lea eax, [ebp - 0x468]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xffff8000
lea eax, [esi + 8]
push eax
push edi
call fcn.1002acb0
push 0xffff0000
lea eax, [esi + 0xc]
push eax
push edi
call fcn.1002acb0
push 0xff00ff00
lea eax, [esi + 0x10]
push eax
push edi
call fcn.1002acb0
push 0xff0000ff
lea eax, [esi + 0x14]
push eax
push edi
call fcn.1002acb0
push 0xffffff00
lea eax, [esi + 0x18]
push eax
push edi
call fcn.1002acb0
push 0x96ff0000
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.1002acb0
push 0x9600ff00
lea eax, [esi + 0x20]
push eax
push edi
call fcn.1002acb0
push 0x960000ff
lea eax, [esi + 0x24]
push eax
push edi
call fcn.1002acb0
push 0x96ef00ff
lea eax, [esi + 0x28]
push eax
push edi
call fcn.1002acb0
push 0x9600deff
lea eax, [esi + 0x2c]
push eax
push edi
call fcn.1002acb0
push 0x96ff9a00
lea eax, [esi + 0x30]
push eax
push edi
call fcn.1002acb0
mov byte [esi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x1011a30c]
cmp byte [ebx], 0
je 0x10038ac4
call fcn.10036ef0
test eax, eax
jne 0x10038ac4
push edi
call fcn.10036f40
mov edi, eax
call fcn.10036e60
test eax, eax
je 0x10038ac3
test edi, edi
je 0x10038ac3
push esi
call fcn.10036ff0
movzx esi, al
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0
cmp dword [ebx + esi*4 + 0x60], 0
jbe 0x10038ac2
xor ecx, ecx
mov dword [ebp - 4], ecx
nop dword [eax]
nop word [eax + eax]
mov esi, dword [ebx + esi*4 + 0x1000]
add esi, ecx
je 0x10038aa6
mov eax, dword [edi + 0x1eba70]
sub eax, 0x271
je 0x10038aa6
cmp byte [edi + 0x1ebe44], 1
jne 0x10038aa6
movss xmm0, dword [esi + 0x70]
xorps xmm2, xmm2
comiss xmm0, xmm2
jb 0x100389c5
movss xmm3, dword [edi + 0x1ebafc]
movss xmm1, dword [esi + 0x64]
comiss xmm3, xmm1
jb 0x100389c5
addss xmm1, xmm0
comiss xmm1, xmm3
jae 0x100389f1
comiss xmm2, xmm0
jbe 0x10038aa6
movss xmm3, dword [edi + 0x1ebafc]
movss xmm1, dword [esi + 0x64]
comiss xmm1, xmm3
jb 0x10038aa6
addss xmm1, xmm0
comiss xmm3, xmm1
jb 0x10038aa6
movss xmm0, dword [esi + 0x74]
comiss xmm0, xmm2
jb 0x10038a16
movss xmm3, dword [edi + 0x1ebb00]
movss xmm1, dword [esi + 0x68]
comiss xmm3, xmm1
jb 0x10038a16
addss xmm1, xmm0
comiss xmm1, xmm3
jae 0x10038a3a
comiss xmm2, xmm0
jbe 0x10038aa6
movss xmm3, dword [edi + 0x1ebb00]
movss xmm1, dword [esi + 0x68]
comiss xmm1, xmm3
jb 0x10038aa6
addss xmm1, xmm0
comiss xmm3, xmm1
jb 0x10038aa6
movss xmm0, dword [esi + 0x78]
comiss xmm0, xmm2
jb 0x10038a5f
movss xmm3, dword [edi + 0x1ebb04]
movss xmm1, dword [esi + 0x6c]
comiss xmm3, xmm1
jb 0x10038a5f
addss xmm1, xmm0
comiss xmm1, xmm3
jae 0x10038a7f
comiss xmm2, xmm0
jbe 0x10038aa6
movss xmm2, dword [edi + 0x1ebb04]
movss xmm1, dword [esi + 0x6c]
comiss xmm1, xmm2
jb 0x10038aa6
addss xmm1, xmm0
comiss xmm2, xmm1
jb 0x10038aa6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x7c]
add ecx, 0x7d0
cmp eax, ecx
jb 0x10038aa3
push esi
mov ecx, ebx
call fcn.10038ad0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x7c], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
sub ecx, 0xffffff80
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
cmp esi, dword [ebx + eax*4 + 0x60]
mov esi, eax
jb 0x10038970
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10038bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x690
push ebx
push esi
push edi
mov edi, dword [0x101195e8]
push 0x100cda9e
jmp loc.1027dfd0
Function at 0x1003a550
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
mov eax, ebx
cdq
and edx, 3
push esi
push edi
lea esi, [edx + eax]
mov edx, 0x2a
sar esi, 2
lea edi, [ecx + esi*4]
neg esi
je 0x1003a593
imul eax, dword [edi + esi*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
rol edx, 0xd
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
add esi, 1
jne 0x1003a570
mov eax, ebx
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x1003a5b9
sub eax, 1
je 0x1003a5b0
sub eax, 1
jne 0x1003a5cf
movzx ecx, byte [edi + 2]
shl ecx, 0x10
movzx eax, byte [edi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, ebx
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
pop ebp
ret

Function at 0x1003c6e0
Capabilities:
Terminate process

Disassembly:
lea esp, [esp + 4]
mov eax, dword [ebp - 4]
test bp, 0x86ba
mov ecx, dword [eax + 4]
cmp ebp, esi
jmp 0x1002910a
push str.CNexusMsg_Error
jmp 0x1002f31d
add ecx, 1
test esp, ebx
cmp ecx, 0x6d60
jmp 0x1007c8d7
push str.Packet_Overlap
jmp loc.1022ba34
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100cda9e
jmp 0x10014998
mov edx, dword [ebp - 4]
bts eax, esp
mov eax, dword [edx + 4]
ror ch, 0xa1
add dl, dh
mov ecx, dword [ebp - 4]
cmp edi, eax
mov edx, dword [ecx]
adc cl, 0x93
mov cl, byte [ebp + 8]
stc
cmp esp, ecx
clc
mov byte [edx + eax], cl
stc
rdtsc
xor cx, si
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
rol ch, cl
shl cx, 0xba
add eax, 1
movsx ecx, ax
mov ecx, dword [ebp - 4]
jmp loc.1024cd6f
jbe 0x1003dd16
push 0x10
jmp 0x10015968

Function at 0x1003c760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100cda9e
jmp loc.10200692

Function at 0x1003c7e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100cda9e
jmp loc.102372d2

Function at 0x1003c860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ecx
push 0x100cda9e
jmp loc.10274996

Function at 0x1003cb60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x100cda9e
jmp fcn.1024d572