joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018e0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x102faeb8], 0
je 0x100018f9
mov eax, dword [0x102faeb8]
jmp 0x10001999
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000190b
xor eax, eax
jmp 0x10001999
push 8
call fcn.100d5632
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001961
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1000194a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100d52ab
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x102faeb8], eax
mov dword [0x102faebc], 0
mov eax, dword [ebp - 8]
jmp 0x10001999
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1000197b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1000192b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x102faec0]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x102faec0], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100038d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and ecx, 0xfffffffc
mov esp, ecx
mov ebp, dword [esp + 0x30]
mov ecx, 0xfffffff8
mov eax, 2
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
add ebx, 0xb10
mov esi, dword [edx - 4]
mov dword [edx - 4], 0xfffffffe
mov dword [ebx - 0xa44], 0xffffffff
jmp 0x1000380b

Function at 0x10007540
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x1000755b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10007566
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10007571
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000757c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10007587
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10007592
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000759d
bts eax, 1
test cl, 2
je 0x100075a6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10007642
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10007633
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10007550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007670
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x10178b24
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call fcn.1012bdd2
add esp, 0xc
test eax, eax
je 0x100076c0
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.1012be19
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x100076f6
call fcn.1012be9b
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.1012c0fd
add esp, 0x10
test eax, eax
je 0x1000774f
push esi
nop dword [eax + eax]
mov esi, ebx
test eax, eax
je 0x10007737
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10007716
mov ebx, dword [ebp - 0x10]
push dword [ebp - 8]
push 0x400
push 1
push ebx
call fcn.1012c0fd
add esp, 0x10
test eax, eax
jne 0x10007710
pop esi
push ebx
call fcn.1012c22e
push dword [ebp - 8]
call fcn.1012be9b
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.100d52b0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10008650
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x10008590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x10008590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x10008590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x10008590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x10008590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x100086e3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000a0b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 8]
mov byte [0x62ebf7], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea eax, [ebp - 8]
mov byte [0x62ee41], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62ee41
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea eax, [ebp - 8]
mov byte [0x62eee4], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62eee4
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 8]
mov byte [0x62ebf8], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 8]
mov byte [0x62ebfe], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea eax, [ebp - 8]
mov byte [0x62ee42], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ee42
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea eax, [ebp - 8]
mov byte [0x62ee48], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ee48
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea eax, [ebp - 8]
mov byte [0x62eee5], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62eee5
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 8]
mov byte [0x62eeeb], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62eeeb
call esi
push 0x10009b70
push 0x520ecf
push 0xe8
call fcn.100b1680
push 0x10009b70
push 0x520f1f
push 0xe8
call fcn.100b1680
push 0x10009b70
push 0x63e743
push 0xe8
call fcn.100b1680
push 0x10009b70
push 0x640eb2
push 0xe8
call fcn.100b1680
push 0x10009b70
push 0x7d2dd9
push 0xe8
call fcn.100b1680
push 0x10009b70
push 0x7e6c0f
push 0xe8
call fcn.100b1680
add esp, 0x48
push 0x10009b70
push 0x84aef7
push 0xe8
call fcn.100b1680
push 0x10009f00
push 0x4dada4
push 0xe8
call fcn.100b1680
push 0x10009df0
push 0x63e71b
push 0xe8
call fcn.100b1680
push 0x10009df0
push 0x63eeb6
push 0xe8
call fcn.100b1680
push 0x10009df0
push 0x6410ee
push 0xe8
call fcn.100b1680
push 0x10009c00
push 0x47e15a
push 0xe8
call fcn.100b1680
add esp, 0x48
push 0x1000a030
push 0x54ee78
push 0xe9
call fcn.100b1680
push 0x1000a050
push 0x54ffb7
push 0xe9
call fcn.100b1680
push 0x1000a070
push 0x5880ad
push 0xe9
call fcn.100b1680
push 0x1000a090
push 0x560ce6
push 0xe9
call fcn.100b1680
mov ecx, dword [ebp - 4]
add esp, 0x30
xor ecx, ebp
pop esi
call fcn.100d52b0
mov esp, ebp
pop ebp
ret
Function at 0x1000f3d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015eef7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1018b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
mov dword [ebx], 0x10178dbc
mov dword [ebx + 0x10], 0x10178db4
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push ecx
lea edi, [ebx + 0x18]
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 0x10], 1
call fcn.10010ad0
mov dword [ebp - 4], 1
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100d5632
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 2
call fcn.100c00b9
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 4
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10010ad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015f013
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1018b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x14], 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.100127e0
push 8
call fcn.100d5632
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 2
call fcn.100c00b9
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov dword [ebp - 4], 3
mov ecx, dword [esi + 4]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 4
push eax
call fcn.10012fe0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov byte [ebp + 0xb], al
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10010c0d
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x10010c0d
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
mov al, byte [ebp + 0xb]
mov byte [ebp - 4], 1
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x10010c2d
mov eax, dword [edi + 0xc]
mov ecx, edi
or eax, 4
push 0
push eax
call fcn.100127e0
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx + 0xc], eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + ebx - 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10017ec0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movd xmm1, dword [0x879340c]
movaps xmm5, xmm2
cvtdq2ps xmm1, xmm1
movaps xmm4, xmm3
movss dword [ebp - 8], xmm5
comiss xmm1, xmm5
movss xmm3, dword [ebp + 0xc]
movss dword [ebp - 4], xmm4
jb 0x10017ff3
movaps xmm0, xmm5
addss xmm0, xmm3
comiss xmm0, xmm1
jb 0x10017ff3
movd xmm2, dword [0x8793410]
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm4
jb 0x10017ff3
movss xmm1, dword [ebp + 0x10]
movaps xmm0, xmm4
addss xmm0, xmm1
comiss xmm0, xmm2
jb 0x10017ff3
movaps xmm0, xmm1
divss xmm0, dword [ebp + 0x18]
push 1
movss dword [ebp + 0x18], xmm0
movaps xmm0, xmm3
divss xmm0, dword [ebp + 0x14]
movss dword [ebp + 0x14], xmm0
call dword [sym.imp.USER32.dll_GetKeyState]
movss xmm2, dword [ebp + 0x18]
mov ecx, 0x8000
movss xmm0, dword [ebp + 0x14]
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
test cx, ax
mov eax, 0x637c60
movss dword [esp + 0x1c], xmm2
movss dword [esp + 0x18], xmm0
je 0x10017f91
cvtps2pd xmm1, xmm2
addsd xmm1, xmm1
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x14], xmm0
jmp 0x10017f97
movss dword [esp + 0x14], xmm2
movss xmm0, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp + 0xc]
movss dword [esp + 8], xmm0
movss xmm0, dword [ebp - 4]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 8]
movss dword [esp], xmm0
push dword [ebp + 8]
call eax
add esp, 0x30
mov eax, 0x791050
push 1
call eax
add esp, 4
test al, al
je 0x10018059
push 0x10329918
call dword [ebp + 0x1c]
add esp, 4
mov esp, ebp
pop ebp
ret 0x18
movss xmm1, dword [ebp + 0x10]
movaps xmm2, xmm3
divss xmm1, dword [ebp + 0x18]
push ecx
mov dword [esp], 0
mov eax, 0x637c60
push 1
push 1
sub esp, 0x20
divss xmm2, dword [ebp + 0x14]
movss xmm0, dword [ebp + 0x10]
movss dword [esp + 0x1c], xmm1
movss dword [esp + 0x18], xmm2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss dword [esp + 8], xmm3
movss dword [esp + 4], xmm4
movss dword [esp], xmm5
push dword [ebp + 8]
call eax
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10018060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movd xmm1, dword [0x879340c]
movaps xmm4, xmm2
cvtdq2ps xmm1, xmm1
movss dword [ebp - 4], xmm3
comiss xmm1, xmm4
movss dword [ebp - 8], xmm4
jb 0x1001818c
movaps xmm0, xmm4
addss xmm0, dword [ebp + 0x20]
comiss xmm0, xmm1
jb 0x1001818c
movd xmm1, dword [0x8793410]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm3
jb 0x1001818c
movaps xmm0, xmm3
addss xmm0, dword [ebp + 0x24]
comiss xmm0, xmm1
jb 0x1001818c
movss xmm0, dword [ebp + 0x10]
divss xmm0, dword [ebp + 0x18]
push 1
movss dword [ebp + 0x10], xmm0
movss xmm0, dword [ebp + 0xc]
divss xmm0, dword [ebp + 0x14]
movss dword [ebp + 0x18], xmm0
call dword [sym.imp.USER32.dll_GetKeyState]
movss xmm2, dword [ebp + 0x10]
mov ecx, 0x8000
movss xmm0, dword [ebp + 0x18]
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
test cx, ax
mov eax, 0x637c60
movss dword [esp + 0x1c], xmm2
movss dword [esp + 0x18], xmm0
je 0x1001812a
cvtps2pd xmm1, xmm2
addsd xmm1, xmm1
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x14], xmm0
jmp 0x10018130
movss dword [esp + 0x14], xmm2
movss xmm0, dword [ebp + 0x24]
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp + 0x20]
movss dword [esp + 8], xmm0
movss xmm0, dword [ebp - 4]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 8]
movss dword [esp], xmm0
push dword [ebp + 8]
call eax
add esp, 0x30
mov eax, 0x791050
push 1
call eax
add esp, 4
test al, al
je 0x100181f9
push 0x10329918
call dword [ebp + 0x1c]
add esp, 4
mov esp, ebp
pop ebp
ret 0x20
movss xmm1, dword [ebp + 0x10]
mov eax, 0x637c60
movss xmm2, dword [ebp + 0xc]
divss xmm1, dword [ebp + 0x18]
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
divss xmm2, dword [ebp + 0x14]
movss xmm0, dword [ebp + 0x24]
movss dword [esp + 0x1c], xmm1
movss dword [esp + 0x18], xmm2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp + 0x20]
movss dword [esp + 8], xmm0
movss dword [esp + 4], xmm3
movss dword [esp], xmm4
push dword [ebp + 8]
call eax
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x20
Function at 0x1001e5d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1018b06c]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x101ee98c], 2
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [esp + 0x18], eax
jne 0x1001e61a
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1001e61a
call fcn.1006e5b0
cmp al, 1
je 0x1001e823
mov esi, dword [0x81f6b6c]
mov eax, 0x5c6e80
call eax
mov edi, dword [ebp + 0xc]
xor ecx, ecx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0xffffffb0
add ecx, 0xffffffc1
lea ebx, [eax + ecx]
cmp edi, 0x32
jne 0x1001e6bb
mov eax, dword [0x7bc4f04]
mov edi, 0x1c
cmp dword [eax + 0x2a4], 0
je 0x1001e6bb
push ecx
mov dword [esp], 0
mov eax, 0x637c60
push 1
movd xmm0, ebx
push 1
sub esp, 0x20
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x1c], 0x3ddd2f1c
mov dword [esp + 0x18], 0x3d9df3ba
mov dword [esp + 0x14], 0
subss xmm0, dword [0x1017e9f4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x41b00000
mov dword [esp + 8], 0x41800000
mov dword [esp + 4], 0x41d80000
movss dword [esp], xmm0
push 0x7a4e
call eax
add esp, 0x30
push 1
mov eax, 0x635fd0
call eax
add esp, 4
mov esi, 0x41fe10
push 0xff
push 0xff
push 0xff
push 0xff
call esi
mov edx, 0x420040
mov ecx, eax
call edx
push 0xc8
push 0
push 0
push 0
call esi
mov edx, 0x4200b0
mov ecx, eax
call edx
push 0
push 3
push 0
push 0x32
push dword [esp + 0x28]
lea eax, [edi + 5]
push eax
push ebx
call esi
mov edx, 0x420150
mov ecx, eax
call edx
movd xmm0, dword [0x103046a4]
lea eax, [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
cvtdq2pd xmm0, xmm0
push 0x40
push 8
push 0xd23ab8
movsd qword [esp + 0x20], xmm0
call esi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
movsd qword [0xd23ab8], xmm0
push dword [esp + 0x1c]
push 8
push 0xd23ab8
call esi
movd xmm1, dword [ebp + 0x14]
lea eax, [edi + 0x10]
movd xmm0, dword [ebp + 0x18]
cvtdq2pd xmm0, xmm0
push 1
push 0
sub esp, 0x14
cvtdq2pd xmm1, xmm1
divsd xmm1, xmm0
mulsd xmm1, qword [0x1017e608]
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x10], xmm0
movd xmm0, eax
mov eax, 0x5b9260
cvtdq2ps xmm0, xmm0
mov dword [esp + 0xc], 0x40800000
mov dword [esp + 8], 0x42480000
movss dword [esp + 4], xmm0
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
call eax
add esp, 0x1c
lea eax, [esp + 0x18]
push eax
push 0x40
push 8
push 0xd23ab8
call esi
movsd xmm0, qword [0x1017e948]
lea eax, [esp + 0x18]
movsd qword [0xd23ab8], xmm0
push eax
push dword [esp + 0x1c]
push 8
push 0xd23ab8
call esi
mov eax, 0x635f50
call eax
sub esp, 0xc
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call dword [sym.imp.OPENGL32.dll_glColor3f]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret
Function at 0x10023320
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x101d86c5], 1
je 0x1002334f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101d86c0]
cmp eax, 0x5dc
jb 0x1002334f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101d86c0], eax
mov byte [0x101d86c5], 1
ret
mov byte [0x101d86c5], 0
ret

Function at 0x10023360
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push edi
push 0
push str.OllyDbg
call esi
test eax, eax
je 0x100233a7
push str._echo_Off
call fcn.10134e70
push str.shutdown__r__f__t_00
call fcn.10134e70
add esp, 8
mov eax, 0
call eax
push 0
push 0x101792d8
call esi
test eax, eax
je 0x100233d2
push str._echo_Off
call fcn.10134e70
push str.shutdown__r__f__t_00
call fcn.10134e70
add esp, 8
mov eax, 0
call eax
push 0
push str.ida64
call esi
test eax, eax
je 0x100233fd
push str._echo_Off
call fcn.10134e70
push str.shutdown__r__f__t_00
call fcn.10134e70
add esp, 8
mov eax, 0
call eax
push 0
push str.idaq
call esi
test eax, eax
je 0x10023428
push str._echo_Off
call fcn.10134e70
push str.shutdown__r__f__t_00
call fcn.10134e70
add esp, 8
mov eax, 0
call eax
push 0
push str.NLClientApp
call esi
test eax, eax
je 0x10023446
mov ecx, 0x103073d0
call fcn.10008650
mov eax, 0
call eax
push 0
push str.NetLimiter
call esi
test eax, eax
je 0x10023464
mov ecx, 0x103073d0
call fcn.10008650
mov eax, 0
call eax
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20c], str.NetLimiter
mov dword [ebp - 0x208], str.NLClientApp
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ebx, eax
test ebx, ebx
je 0x10023518
push 0x100
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x100
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor esi, esi
nop dword [eax + eax]
mov edi, dword [ebp + esi*4 - 0x20c]
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.10122db0
add esp, 8
test eax, eax
jne 0x100234f7
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.10122db0
add esp, 8
test eax, eax
jne 0x100234f7
inc esi
cmp esi, 2
jl 0x100234c0
jmp 0x10023501
mov ecx, 0x103073d0
call fcn.10008650
push 0
push 0
push ebx
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ebx, eax
test ebx, ebx
jne 0x10023490
call fcn.10023540
call fcn.100235d0
call fcn.10023650
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d52b0
mov esp, ebp
pop ebp
ret